Let's JAM!

Self-signed certificates can be a good thing

There have been several incidents of SSL Certificate Authorities signing keys for the purpose of impersonation. The most recent of the incidences was Trustwave. When an attacker gets a SSL cert that identifies them for something they are not, a man in the middle attack becomes much more simple. This is one of the sole things that SSL was designed to prevent.


This is where self-signed certificates can - and will - win. So long as you are not troubled by the distribution method and can control the distribution, self-signing a certificate can be much more secure than using a certificate signed by a third party.


Things like mail servers, VPN servers, personal web servers, chat servers, and other personal entities are usually much better off self-signing. Since you, the owner and operator of the server, signed the certificates, you are in control of what does and does not get signed. You are able to keep the signing certificate in a secure and private location, such as an encrypted flash drive. So long as proper SSL checks are performed, impersonating your server should be damn near impossible. No one else has access to your signing cert, so spoofing is not a concern.


Obviously, this is assuming you don't trust other certificates that are not you, at least, not for these services. If third party certs are still trusted, spoofing can happen in the same way.


So, self-signed certs can be extremely useful, especially in the right situation. By not having a centralized issuing service, many of the dangers of using SSL are mitigated.