Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are trying to secure an internal web site with SSL. Currently we are using a self signed certificate that is not trusted by the site's users.

Is it possible to buy a certificate from a trusted CA and use it in an internal network?

share|improve this question

closed as off topic by Chris S Dec 10 '12 at 13:38

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined by the community. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about reopening questions here.If this question can be reworded to fit the rules in the help center, please edit the question.

    
Product reccomendations are off-topic on all Stack Exchange sites. Please see the FAQ for details. Thank you! –  Chris S Dec 10 '12 at 13:38
add comment

2 Answers

up vote 4 down vote accepted

Yes of course - just dont forget that some CAs will want a valid email address at exactly the domain certified, so you will either need an externally visible hostname to your intranet site or get a wildcard cert (which will still need a reachable email address a level up, but not require you to expose your whole internal DNS zone externally. Rather expensive...)

For the more modern way, googling "Intranet ssl certificates" will find a few vendors... recommendations would definitely be "too localized".

share|improve this answer
add comment

You don't mention the type of network you have setup but the alternative here is to simply deploy your self-signed certificate as a trusted certificate.

If you are using Windows its pretty easy to do this with GPO policies. I am sure there are other deployment methods as well for non-windows clients but they may not be as simple. Ultimately though, deploying an internal Certificate Server is the holy grail as then you can trust any certificate you need to issue.

The simple deployment of a self-signed cert gives you a pretty easy solution without the yearly on-going cost of a public cert. Obviously if you ever intend to extend the intranet site out to serve as an extranet this doesn't work too well for you.

share|improve this answer
add comment

Not the answer you're looking for? Browse other questions tagged or ask your own question.