Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

I wanted to install an SSL certificate for a domain. So I googled up and did some R&D and found this link https://www.symantec.com/page.jsp?id=roots.

It says we can download and use without any charge. So I have downloaded the pem file. Now I need to set it up on nginx server.

So now I have the pem file but not the CSR key.

  • Is it okay if I generate and use a self signed private key?
  • Would there any problem if I use this?
  • Any browser related issues?

Since it my first time I am configuring a ssl cert, I am totally unclear on how to go about it.

Please share your experiences?

Thanks in advance.

share|improve this question
2  
I think you should read the Wikipedia Public Key Infrastructure article. –  MDMarra Jan 20 at 0:40
add comment

1 Answer

up vote 4 down vote accepted

The link you've posted is the root bundle so that your computers will trust certificates signed by Symantec - modern browsers should have this installed already. Symantec is not allowing you to download a signing certificate that can be used by you to create a certificate that is trusted by default at no cost. That would be silly. In short, you can't use the file you've linked to in order to create new certificates.

If you want a certificate that will be trusted by most browsers, you're going to have to submit a CSR to an SSL vendor and likely pay. Some lesser-known vendors like RapidSSL or StartSSL may have discounted or even free certificates for limited use, but if you want something from a major vendor like Symantec (Verisign), Thawt, Entrust, etc, you're going to need to shell out $$.

If you want to create your own PKI, which has no monetary cost, you'll need to create your own certificate authority and have it issue a root certificate. That root certificate will have to be installed on every computer that you wish to have trust your certificates.

There is a third option, where you can have your own internal CAs signed by third-party trusted roots, in which case you could issue certificates that are inherently trusted, but if you're asking this question, you're nowhere near ready for something like that. The requirements are rigorous.


TL;DR - If you want this to work seamlessly on computers that you don't control, you need to pay.

share|improve this answer
    
Thanks @MDMarra, I doubted that. –  user123 Jan 20 at 1:50
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.