Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

If I buy some certificate from, say, Thawte or Verisign etc. they have only time limits right?

Or do they also have number of connections limits? I think not, and I never met this limit. But I would like to know.

Also, if I buy SSL Certificate from one of those, would system require the Internet access? What if the system is intended to be used only in Intranet with no public access?

share|improve this question
up vote 1 down vote accepted

No, there are no connection limits - only time limits & IP/domain address limits (typically a single address & domain).

You need to have something that connects to the Internet if you want a certificate from them since you need to create the keys and signing file locally and send some of this to them, they then add their bit and send you something back - typically this happens using a web page but it can be done over email too.

The information you receive back then needs to be put back onto the server. You could do this via USB stick if needed so the server doesn't need Internet access.

But then, as @pjc50 has pointed out. If the server doesn't have Internet access, do you want to have a publicly certified certificate?

Privately certificates are fine for testing purposes but a corporate/enterprise intranet should have a certificate issued by your enterprise PKI not a public PKI.

share|improve this answer
so the Internet access is needed only when we get that certificate. That's right, and then it doesn't need Internet connection. That's right too. So after this, browsers wouldn't complain with: "The site's security certificate is not trusted!" right? I think yes. (otherwise why we'd need those certs). Thanks! – bakytn Jul 17 '12 at 5:09
@casey_miller: You actually don't need to buy those certs in the first place, since you're in a controlled local environment. You can set up your own internal PKI on your intranet, similar to Thawte and Verisign on the public Internet. – MSalters Jul 17 '12 at 11:25
@MSalters I know. But people would complain about "Untrusted source" error in Browsers. – bakytn Jul 17 '12 at 11:38
@casey_miller: Once you've used an external PKI, the browsers stop complaining as long as that PKI is trusted by the browser. There is an alternative though. You can add your own PKI to the trusted certificate list in the browser (or the Windows cert store if using IE). This has the same effect but without the need to certify externally. – Julian Knight Jul 17 '12 at 11:39
With PKI, it is always hard to be sure. If it is managed correctly then yes, simply because it is less likely to be attacked & everything is directly under your control. BUT, PKI is fairly easy to get wrong because it is somewhat sensitive to configuration errors. – Julian Knight Jul 17 '12 at 16:09

There is no connection limit. You need to have access to the internet to buy the certificate, but then you can move the cert and private key (this is the important item!) to a private system.

But if you have a private system, then you can sign a certificate with itself for free; or you can set up your own certification authority within the system.

share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .