2 ms·
But self-signed certificates are more secure than CA-signed certificates, because they don't involve a third party. My various servers only use self-signed cert
by bandrami 12y ago
But self-signed certificates are more secure than CA-signed certificates, because they don't involve a third party. My various servers only use self-signed certificates among themselves because it drastically reduces the amount of initial trust required.
The huge problem there is key distribution (easy since I run all the servers), but in terms of just "security" that's much more secure than involving a third party CA.
- brazzledazzle 12y agoSelf signed is one thing in an internal environment/infrastructure role but quite another in a web server interacting with the public role. You're comparing apples to oranges.
- bandrami 12y ago"Internal" begs the question of key management, which is the whole issue to begin with. At any rate, my claim stands that a self-signed certificate is by nature more secure than a CA-signed one, because it does not require the additional level of trust in the CA.
- brazzledazzle 12y agoIt's only more secure between two parties that can reliably confirm their identities with each other out of band. A CA, however badly implemented in practice, is more secure by design because the worst case scenario (a subverted CA) is no different from a self-signed certificate from a client perspective. In terms of what you're focusing on in this thread (verification of identity) I don't disagree. But a MitM attack on coffee shop wifi is a problem which is exacerbated by self signed certificates.