-5

I have seen similar questions and answers, but none really answer my question effectively.

There are 2 problems that SSL answers: Encryption and trust.

Time for a truth table:

                        | Encrypted | Trusted |
------------------------|-----------|---------|
No certificate          | No        | No      |
Self-signed certificate | Yes       | No      |
CA verified certificate | Yes       | Yes     |

Based on this table, why exactly do browsers give me a huge scary red warning telling me that a self-signed certificate is dangerous, when clearly it is safer than an unencrypted connection?

An answer I've seen to a similar question, is that self-signed certificates aren't trusted. That's fair enough, but then why don't I get a huge scary red warning telling that an unencrypted connection is dangerous?

Am I missing something? Can self-signed certificates be compromised in some way that CA verified ones can't?

This crops up a lot for me. An example: I set up a system to be used internally by staff, both office based and on their own computers. I don't care if they trust the certificate, all I'm concerned about is that the connection is encrypted. This is fine in the office as I can remotely roll out the self-signed certificate onto the computers to trust, but I can't do this on computers that belong to the employees or those out on the field.

  • 1
    You might want to review this question. It's the same question, but asked from a different perspective. In essence: if the computer can't follow the certificate back to its source (a trusted source) it can't validate it. Meaning anyone could create a certificate under the same name, and your browser wouldn't know the difference. The reason this warning only appears for encrypted connections is because we assume those are safe, we don't for non encrypted. – Reaces Feb 9 '15 at 12:11
  • If you're securing internal applications, often it is fairly trivial to set up an internal CA and distribute the CA certificate to your users. Then you can easily provide your own signed certificates without the issues of self-signed certificates. – HBruijn Feb 9 '15 at 12:45
1

Browsers warn about untrusted SSL certificates because users expect an SSL-protected connection to be safe for transmitting sensitive data.

Looking at it from your point of view, you use an SSL certificate to encrypt data between two computers at your company. You do this instead of using a non-encrypted connection because you have something secret to transmit. A secret is meant to be shared only with those authorized to know it, so it matters who's at the other end of the connection.

For that reason your browser warns you when it can't confirm the identity of the remote computer.

1

If a certificate is self-signed, and not known by your browser, you can send informations to a man in the middle. Some sensitive informations can be sent to to bad guy. If your self-signed certificate is known by your browser, you will not have the exception and the connection will be encrypted.

You are right : the non enctypted connections are bad, but not verified self-signed certificates too.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.