For an intranet server would you buy a ssl cert or use a self signed cert?

Question

We have a webservice that our application uses and the developers require https connections to the webservice. Since this is an internal webservice would you use a self signed cert?

Answer 1

Rather than a self-signed cert I'd create a local root CA and then generate the SSL cert from that, ensuring that all internal systems have a copy of the root CA'sl public key.

Keys generated this way have plenty of uses outside of plain HTTPS, they can also be used for OpenVPN, POP3S, SMTPS, etc, even for individual SMIME accounts.

Having a single root CA for your organisation is a lot better than being held to ransom by the recognised CAs who'll charge you for each and every server you want a certificate for, and dare to charge you a "license fee" if you want to put the same cert on multiple servers in a load-balanced cluster.

Answer 2

try CAcert. they are free, you just need to have the root installed. one step above having self signed certificates.

Answer 3

Assuming that you are a Windows Domain for your desktops, setup a Windows CA in house which will automatically be trusted by all the computers in the company via AD. This way you can issue certs to what ever internal apps you need without having to purchase a cert.

Answer 4

If cost is an issue and you're Windows centric, as Mr. Denny suggests, go with Microsoft Certificate Services and deploy the certificates as part of the Default Domain GPO. You'll likely need three systems, but then can be VMs. You'll need the root CA, which should only be used for issuing the certificates for the intermediate CAs. You should have one intermediate CA as the Enterprise CA and then the third as a "stand-alone" CA so you can issue certs to non-domain assets.

If you've got a lot of clients and you are big enough, you may look at having a root from one of the third party solutions and issuing your own certificates from a CA that gets its certificate from said third party. That way you don't have to deploy the CA's certificate. For instance, there is a solution from GeoTrust.

Answer 5

For the low price of starter certs, like rapidssl, I would probably purchase one of these, at least if you only need a minimal amount of them. I feel its worth the small fee to stop users being asked to accept the untrusted self signed cert, as it always causes some issues with non-technical users.

Answer 6

Usually, yes, I'd use a self signed PEM certificate for such things. However, how sensitive is the site on your intranet? There are good practices to follow regarding the machine that actually signs the certs .. and others, which may or may not apply to you.

Also, how would an internal CA store be configured for users? Once you accept a cert, you'll know if it changes .. which brings me back to good practices involving the machine that actually signs them (i.e. sign, then unplug it).

Its handy to have your own internal CA, if you manage it correctly. Please provide more information.

Answer 7

The problem with a self-signed cert is the clients will generally spew warnings about it being unverified. Depending on security settings, some may block it altogether.

If this is purely an internal need, why even use https instaed of http?

Personally I'd either stick with http or buy a cheap cert (they're not that expensive).