4

I have a domain that I want to have webmail on, and I want it to be secure. I'm the only one who uses this site, yet I still want it to be secure.

I can't afford, and I don't think it makes sense to pay a CA to sign my cert.

I have SSL working at the moment with my self signed cert...but I want to know if it is enough.

If someone generates a self signed cert with the same info as my certificate, is there any way I can tell, short of memorizing the serial number or something?

Improve this question
3
  • CA-signed certs are really not very expensive these days - it's possible to get one for < $15/year at GoDaddy or some Comodo resellers. StartSSL (www.startssl.com) will give you a basic CA-signed cert for free, though they want $50 to do the validation for more complicated certs (such as wildcard certs).
    – gbroiles
    Sep 4, 2010 at 9:31
  • Are there any free CA singed certs that are automatically in the browsers ring of trust?
    – user47587
    Sep 4, 2010 at 19:31
  • StartSSL is in newer browsers.
    – gbroiles
    Sep 4, 2010 at 19:50

4 Answers 4

Reset to default
4

If you create your own certificate, generated from your own Certificate Authority, you can configure your browser of choice to trust that CA. That way it will trust the certificate you created from that CA. A random person creating a certificate with identical information to yours should cause your browser to throw SSL validation failure errors, since that certificate would not be signed by a CA you trust.

Improve this answer
3
  • I thought of that, but what I want to secure is webmail. The point of this is that I often check my mail via webmail from internet cafes, hotel computers or whatever, maybe even a friends laptop. When I have to confirm that I trust the certificate, how can I differentiate my certificate from an attackers?
    – user47587
    Sep 4, 2010 at 5:04
  • 2
    @Jacob Ah, for THAT you will have to actually look at the cert. Most browsers allow you to at least view it before accepting it. You'll have to memorize some hex-numbers.
    – sysadmin1138 ♦
    Sep 4, 2010 at 5:50
  • Ahh, so it does come down to memorizing the unique aspects of the cert. Dang...and thanks.
    – user47587
    Sep 4, 2010 at 6:12
2

If you are the only one to use the domain, then a self-signed certificate is sufficient. Creating your own certificate means generating your own CA private key. As long as you can keep this private key secure, you then don't have to worry about anyone forging certificates. Without this private key it's impossible for anyone to generate a certificate with the same public key, and you will be able to tell by comparing the public keys.

Improve this answer
3
  • How does that help with a mitm attack? If someone provides their own certificate for my domain with the same information, how would I be able to detect this ...unless I memorize some of the numbers unique to my certificate?
    – user47587
    Sep 4, 2010 at 3:47
  • Jacob - the point is that the information you enter while creating the certificate have nearly nothing to do with the randomly-generated part of the key. It would be next to impossible for someone to generate an identical key.
    – EEAA
    Sep 4, 2010 at 4:09
  • I understand that, my problem is how would I tell an attackers key from my own key without looking at the huge random string of numbers? I travel a lot and am not always on my own PC, so any kind of whitelist solution won't work.
    – user47587
    Sep 4, 2010 at 5:03
2

You can save the CA public key file on a memory stick and import it into any browser you are using.

The file could also be on the web at an address you can easily remember.

It may be worth your time to look at joining CACert (http://www.cacert.org/) so you only have the one CA to worry about for multiple uses.

Improve this answer
0

By becoming your own Certificate Authority, you provide authenticity to the certificate by creating a signature of it. This is done via a signature which is signing via the private key. The public key is then used to verify that the signature was indeed signed by the private key.

Because only the CA (you) knows the private, you trust that the CA verified the certificate and it is authenticate. To trust the CA, you install the CA's certificate (which contains the public key) into your ring of trust, generally in Windows this is done by double clicking the certificate file and verifying you wish to trust it. In Firefox it's done by adding it within the Certificates area of the Options.

The key to the above is making sure that no other CA in your ring of trust could potentially sign the signature. This is why the CAs verify the owner of the domain before signing a certificate for that domain.

If you'd like to learn more of the details of cryptography including public/private:

http://www.pgpi.org/doc/pgpintro/

An amazing book on the subject is Applied Cryptography. A much simpler book is Cryptography Decrypted.

Improve this answer
2
  • The problem with this, is that the whole point of webmail is that I can check my email from computers that are not my own. I travel a lot, so I often use hotel computers, internet cafes etc. I want to be able to check my webmail securely. As my CA is not in a ring of trust, when I am on a new computer, I have to (in firefox) confirm the exception, and then allow the certificate. My question, is that if someone is doing a MITM attack on me, how can I know if I am allowing my certificate, or the attackers?
    – user47587
    Sep 4, 2010 at 5:02
  • OK I see your point, in that case it's memorizing the fingerprint as sysadmin1138 said. It may also be more secure to carry around a portable usb firefox. Also, don't forget the keyloggers.
    – Rob Olmos
    Sep 5, 2010 at 8:54

You must log in to answer this question.