Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote 0 down vote favorite

I'm confused about all the complexity of certificate authorities, self-signed vs third-party signed certificates, etc. Why can't there be a solution as simple as ssh?

I was hoping I could authenticate an https connection like this:

  1. Create a key pair.
  2. Install the public key on the web server
  3. Install the private key on the client browser(s).

Why is it not as simple as this?

All I want is to secure my own private https website. I'd be the only user

share|improve this question
That is not a question, that's a complain. Securing a web site with self-signed client certs is perfectly possible but since you don't specify what software you're using, no meaningful explanation can be formulated. – Stephane Jul 12 '11 at 15:07

1 Answer

up vote 1 down vote accepted

A handful of specialist people log into the average server by SSH. It's feasible for the sysadmin to give you the fingerprint of the server and have you verify it when you log in.

Millions of people log into a popular https website. If they have to do anything too complex, they won't open their wallet.

If you want a self-signed SSL certificate, it can be as simple as SSH (SelfSSL on Microsoft IIS, the ssl-cert package on Ubuntu for Apache). You have all of the encryption and none of the trust, just like with SSH.

See also: why is no-one using SSL client certificates.

share|improve this answer
Ah... but all I want is to secure my own private https website. I'd be the only user. – user13097 Jul 12 '11 at 15:01
One of crb's links is definitely where you want to go then! – PriceChild Jul 12 '11 at 15:04

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.