Ask HN: How bad is it to use a self-signed SSL certificate?

#1

Post by mark_l_watson » Sat, May 31, 2014, 3:31 PM UTC

I have a few "information only" (i.e., no customer data stored, no user logins) for almost 20 years that I just added HTTPS support for.

I did this after reading the EFF's "Join us on June 5th to Reset the Net" article and the two linked articles at the bottom of the page.

If any accesses my sites with HTTPS, they have to look at my certificate and OK it. A pain.

Ask HN: How bad is it to use a self signed SSL certificate?

Also, suggestions for the cheapest/easiest ways to get signed certificates?

BTW, I used this article for configuring nginx for SSL: https://www.digitalocean.com/community/articles/how-to-set-up-multiple-ssl-certificates-on-one-ip-with-nginx-on-ubuntu-12-04

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#2

Post by cjbprime » Sat, May 31, 2014, 3:34 PM UTC

It's terrible, because Man-In-The-Middle attacks are trivial and automatable.

namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#3

Post by mark_l_watson » Sat, May 31, 2014, 3:41 PM UTC

cjbprime wrote: post #2

It's terrible, because Man-In-The-Middle attacks are trivial and automatable. namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.

Thanks. I needed some encouragement. I will buy two PositiveSSL certificates today.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#4

Post by nmb » Sat, May 31, 2014, 3:44 PM UTC

mark_l_watson wrote: post #3

cjbprime wrote: post #2

It's terrible, because Man-In-The-Middle attacks are trivial and automatable. namecheap.com sells PositiveSSL certs for $9/year -- that's pretty cheap and easy.

Thanks. I needed some encouragement. I will buy two PositiveSSL certificates today.

You might be able to use StartSSL's free one: https://www.startssl.com/

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#5

Post by oceanstone » Sat, May 31, 2014, 3:44 PM UTC

It's good, because you have control over the certificate creation, and never have to share your private key.

The one catch is, as you noticed, the key has to be distributed. Depending on your goals, and your audience, this might be impractical, or within the realm of reason.

Here's a link that goes into more detail.

https://blogs.oracle.com/java-platform-group/entry/self_sign...

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#6

Post by jeffmould » Sat, May 31, 2014, 3:47 PM UTC

If money is short at the time you can also get a 90-day free SSL from Comodo. Good for testing and getting SSL setup or if you are tight on funds at the time it can get you started until you have the cash on hand to purchase the certificate.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#7

Post by ckuehl » Sat, May 31, 2014, 3:50 PM UTC

oceanstone wrote: post #5

It's good, because you have control over the certificate creation, and never have to share your private key. The one catch is, as you noticed, the key has to be distributed. Depending on your goals, and your audience, this might be impractical, or within the realm of reason. Here's a link that goes into more detail. https://blogs.oracle.com/java-platform-group/entry/self_sign...

> It's good, because you have control over the certificate creation, and never have to share your private key.

You will never have to share your private key when getting a certificate from a proper CA, either.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#8

Post by kamaln7 » Sat, May 31, 2014, 3:54 PM UTC

nmb wrote: post #4

mark_l_watson wrote: post #3

Earlier quoted context omitted.

Thanks. I needed some encouragement. I will buy two PositiveSSL certificates today.

You might be able to use StartSSL's free one: https://www.startssl.com/

Just keep in mind that Class 1 (free) certificates are for non-commercial sites only.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#9

Post by Yaa101 » Sat, May 31, 2014, 3:54 PM UTC

Depends what you want, if you want trust that you can only grant yourself, then go for self signed, especially internal projects.

If you want exposure of your certificates to common browsers and don't want to raise warnings in them, go for cert authorities.

But remember Snowden, certificate authorities are less trustfull than you can trust yourself.

Re: Ask HN: How bad is it to use a self-signed SSL certificate?

#10

Post by binarymax » Sat, May 31, 2014, 3:57 PM UTC

As others have said - don't use a self-signed cert. When you do settle on a CA and config your SSL - this tool from SSL labs will really help. I used it today to identify and resolve a chaining issue. It makes sure you've done everything correctly.

https://www.ssllabs.com/ssltest/analyze.html