Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

I have my own server on a dedicated ip. Can I just generate an SSL certificate or do I still need to buy one from a company such as Network Solutions?

Whats the major difference between the two?

share|improve this question

4 Answers 4

The only difference is which certificate authority signed your certificate - and, consequently, the answer to "is that CA trusted by browsers by default".

Browsers have a set of CA certificates that they trust to sign certs. If your CA is not in that set, the user gets a big fat warning.

Nothing else in SSL, including the encryption, is changed - but that warning is threatening enough that you can't run a commercial service without a certificate signed by one of the trusted set of CAs.

share|improve this answer
    
Although, one might argue, with recent events, that the trusted CAs are not to be trusted either. ;) –  Patrick S. Feb 14 '12 at 1:14
1  
I thought about saying "...which is what grants the CAs the ability to charge crazy money for what is relatively little actual effort on their part", but it seemed too focused on personal opinion. :) –  Daniel Pittman Feb 14 '12 at 1:16
    
The theory is, the CA has done some form of research to prove that you or your company are who you say you are and that you are a company that is "trustworthy." –  Keltari Apr 23 '13 at 12:23

The difference is that the one that you buy comes from a trusted source.

If you create one yourself, every visitor has to register the certificate as trusted in the browser.

share|improve this answer

To expound the other answers, it helps to know what purpose certificates serve and how they work.

When you perform certain actions (most frequently browsing secure web pages, ie HTTP​S, or verifying the legitimacy of files), the computer has to check if it is reliable. It does this by examining the web site’s security certificate (or file’s digital signature). It does some cryptographic maths, but to be sure that it was not faked or tampered with, it ultimately has to check with someone else.

This is done by checking a known, trustworthy server (that’s why you cannot do such checks while offline, even if it is cached). The system connects to an external server Certificate Authority (CA) and checks to see if the cert is valid (it needs to know if it is real at all, and whether it has expired). When a cert is compromised, they need to invalidate it, so you need to be able to check if a cert has expired.

Now, when you use a self-signed certificate, you are the only one who knows whether it is valid. That means that when other users browse your secure site or download your files, they cannot use standard CAs to check your certificate. They need to contact your server (which defeats the purpose—what would stop hackers from signing viruses and running their own cert servers?). To avoid that, you would need to have everybody who is to use your certificate install it in their system’s certificate store, and in the Trusted Root CA store at that!

This has two problems. First, it requires people manually performing installing the certificate in the (nobody bothers with anything that requires them to do anything). Second, it requires them to perform scary and advanced security action that could potentially lead to problems (even if they do it, there are enough warnings and flags in the process that they will probably just run away).

In summary, using a self-signed certificate is okay in some circumstances such as a home network or other local network like in a lab or office. However for the Internet in general, it will not be sufficient and you will need to get one signed by one of the bigger CAs (preferably one of the ones whose cert is included with Windows). Fortunately there are several to choose from and they range in price from yay-I-can-afford-that to what-am-I-Bill-gates.


Figure 1: Importing a certificate

enter image description here

Figure 2: Big, scary warning about importing a cert to the Trusted Root CA

enter image description here

share|improve this answer

An SSL certificate does one thing. It says "this key belongs to this server". If you generate a certificate yourself, that means that you are saying your key belongs to your server. But anyone who trusted you to say that wouldn't need the certificate. The point of a certificate from a CA is for the CA to say that the key belongs to your server. That way, people who trust that CA will know they reached the server they intended to reach.

You can think of it as something like a driver's license being used to open a bank account. The license says that your picture goes with your name, and the bank trusts the issuer of the license not to issue licenses that don't have the correct picture to name mapping. If you made your own driver's license, nobody would trust it to map your picture to your name unless they already trusted you, which would sort of defeat the point of having it.

You don't need to buy one. There are CAs that will issue them for free, confirming your ownership of a domain by email or by having you put a particular code on its web server.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.