Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

At work, I have a bunch of web interfaces that use plain http or self signed certificates (load balancer management interface, internal wiki, cacti, ...).

None is reachable from outside specific vlans/networks.

For home usage, I use cacert SSL certificates.

I was wondering if I should suggest my employer to use cacert SSL certificates instead of self signed certificates and plain http. Anyone use cacert ssl in production? What are the pro/cons? Does it improve security? Is it easier to manage? Anything unexpected? Can it affect qualys scans? How can I convince them?

Of course, paid certificates for public websites would remain unchanged.

Edit :

(just curious) Free ssl certificate from companies do not seem to be class 3. I had to show my passport and be present physically to get class 3 from cacerts. Isn't there warning in browsers for each class 1?

Anyway, I would have the same question about any free CA : Is it better than using self signed and plain http, and why ?

I would do it for ease of management, server side. Anything I missed?

Disclaimer : I'm not a cacert association member , not even Assurer, just a regular happy user.

share|improve this question
    
Certificates from different "Class" are not treated any differently in browsers, it's completely on user's side to trust them or not. The only kind of certificates that receive special treatment from browsers are Extended Validation Certificates. –  Hubert Kario Oct 6 '12 at 14:49
add comment

3 Answers

up vote 3 down vote accepted

I would advise that while there's nothing wrong with using free certs, like from CACert, you probably won't gain anything from doing so either.

Since they're not default trusted by anything, you'll still need to install/deploy the root certificate to all your clients, which is the same situation you'd be in with self-signed certs or certs issued by an internal CA.

The solution I prefer (and use) is an internal Certificate Authority and a mass deployment of its root certificate to all domain machines. Having control over the certificate authority you use makes certificate management a lot easier than even through a portal site. With your own CA, you can generally script up a certificate request and corresponding certificate issue so that all your servers, sites, and anything needing a certificate can get it automatically and be trusted by your clients almost immediately after being put into your environment, with no effort or manual tasks by IT.

Of course, if you not up to the task of setting up and automating your own CA, then using an external free one like the one you mentioned could make your life a little easier, only having to deploy one external root certificate... but you should probably try to do it right the first time, and set up an internal CA for your domain.

share|improve this answer
    
Setting up internal Certificate Authority is not likely to be done because it costs time to setup, but I believe it's better than free ssl certs. –  Eric DANNIELOU Oct 5 '12 at 7:53
add comment

Is it better than using self signed and plain http, and why ?

Self-signed certificates will train your users (and YOU) to click through warnings habitually, which is a bad habit. What if that Self-signed certificate was replaced with a rogue certificate? Would your users notice, or would they blindly click through yet-another-security-dialog?

share|improve this answer
add comment

I would suggest free SSL Certificates from StartSSL, which are recognized by modern browsers too. I've got nothing against CACert except that it doesn't take anything but an account to issue certificates, and those certs are not recognized by anyone unless you manually install the root cert.

Obligatory disclaimer as this is a product recommendation: I'm not affiliated with StartSSL in any way. Just a happy customer.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.