Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Well, how to make a client SSL certificate, which doesn't need an (external) certification authority?

Is there a way and is any profit to use elliptic curves for that?

What should i do to use it on a server? How to make a server accept a certificate? How does a server know which user has logged in?

share|improve this question

migrated from Mar 6 '13 at 17:44

This question came from our site for information security professionals.

Have you tried searching that out? Perhaps this would be helpful:… It was the #6 result when I searched. (This question right here was #5) – George Bailey Mar 5 '13 at 22:06
I tried. If i search for "self-signed client SSL certificate", word "client" is simply ignored. >This question right here was #5< - wow, that fast? – Smit Johnth Mar 5 '13 at 22:32
Still no detailed answer? – Smit Johnth Apr 6 '13 at 18:56

A self-signed client certificate for SSL is just a self-signed certificate with a key suitable for signatures. Just about any self-signed certificate will do, as long as you do not explicitly restrict it to encryption (i.e. don't insist on including a Key Usage extension, and you'll be fine).

Elliptic curves are massively spiffy. But not everybody supports them yet. Advantages of elliptic curves are that they yield shorter public keys and smaller and faster signatures than RSA. Not that it matters much anyway (as a human being, you cannot make the difference between 50 and 1000 µs). More importantly, using elliptic curves confers early adopter status. It is the cryptographic equivalent of buying a red sports car.

share|improve this answer
>as a human being, you cannot make the difference between 50 and 1000 µs< - try running openssl speed on your desktop and consider that there are more weaker devices like DSL routers. ECC is faster in anything excluding verifying signatures - that's why i asked. – Smit Johnth Mar 5 '13 at 23:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .