Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Well, how to make a client SSL certificate, which doesn't need an (external) certification authority?

Is there a way and is any profit to use elliptic curves for that?

What should i do to use it on a server? How to make a server accept a certificate? How does a server know which user has logged in?

share|improve this question

migrated from security.stackexchange.com Mar 6 '13 at 17:44

This question came from our site for Information security professionals.

    
openssl.org –  TildalWave Mar 5 '13 at 21:49
    
Have you tried searching that out? Perhaps this would be helpful: techlx.blogspot.com/2010/05/… It was the #6 result when I searched. (This question right here was #5) –  George Bailey Mar 5 '13 at 22:06
    
I tried. If i search for "self-signed client SSL certificate", word "client" is simply ignored. >This question right here was #5< - wow, that fast? –  Smit Johnth Mar 5 '13 at 22:32
    
Still no detailed answer? –  Smit Johnth Apr 6 '13 at 18:56

1 Answer 1

A self-signed client certificate for SSL is just a self-signed certificate with a key suitable for signatures. Just about any self-signed certificate will do, as long as you do not explicitly restrict it to encryption (i.e. don't insist on including a Key Usage extension, and you'll be fine).

Elliptic curves are massively spiffy. But not everybody supports them yet. Advantages of elliptic curves are that they yield shorter public keys and smaller and faster signatures than RSA. Not that it matters much anyway (as a human being, you cannot make the difference between 50 and 1000 µs). More importantly, using elliptic curves confers early adopter status. It is the cryptographic equivalent of buying a red sports car.

share|improve this answer
    
>as a human being, you cannot make the difference between 50 and 1000 µs< - try running openssl speed on your desktop and consider that there are more weaker devices like DSL routers. ECC is faster in anything excluding verifying signatures - that's why i asked. –  Smit Johnth Mar 5 '13 at 23:29

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.