In the last few days I was trying to understand the story of certificates, and I understood the main principle of them, but I didn't understand that step when we create a CA cert to sign my own server cert.

I will summarize here what I have understood about creating new certificates to use them with the services on my server and please tell me if everything is right and help me to understand the points which I miss or don't understand:

  1. I create my own private key randomly (server.key)

  2. I generate my public key according to the previous public key (server.csr), and this file is just a normal certificate but without any signing.

  3. I repeat the last two steps to get ca.key and ca.csr. and let them to sign themselves somehow to get ca.crt (I don't understand the self-signing process here).

  4. use them to sign my server.csr to get server.crt.

Now what I don't understand, if I were able to self sign the files in the step 3, why didn't I easily just do the first two steps and let them to sign themselves to get that server.crt file?

I believe that I misunderstand something about that self signing process, but unfortunately I saw a lot of videos and read a lot of articles but nothing helped to repair that.

  • If it’s signed by another key, it’s not self-signed. – Daniel B Jan 26 '16 at 16:23
  • If you are creating a self-signed certificate which signs another certificate, its still self-signed, but not directly. You could have stopped at the first certificate if you wanted, you don't gain much, unless you have a need for multiple certificates and want to be able to revoke certificates within your own infrastructure. – Ramhound Jan 26 '16 at 16:25
  • @Ramhound ok that makes sense now, thank you. – Mohammed Noureldin Jan 26 '16 at 16:27
  • Given the differences in the answers you are getting, your question isn't all that clear, you need to identify what you don't understand about certificates and ask that question at the end of your question. Its not clear the reason you are creating your own Certificate Authority (CA) certificate, perhaps just providing that information, would help clear your question up. Any certificate you create, you are going to implicitly trust, since you would be the only person that has both the public and private key. – Ramhound Jan 26 '16 at 18:12
  • 1
    So it sounds like you should create your own CA certificate, then create additional certificates for each service signed by that CA you created, then configure the OS to trust all the certificates you created and the CA certificate you created. Since you implicitly trust the certificates you create, there is no point in getting a trusted CA to create and sign your certificates, since the level of trust wouldn't necessarily be increased. Unless of course you trust that CA more then you trust yourself? – Ramhound Jan 26 '16 at 19:17

Sure, you could do that.

Your full process isn't even what is usually called "self-signing" – you're actually making a whole CA hierarchy here. Some tutorials advise doing this in order to make future certificate replacements easier – instead of having to update all clients for the new self-signed cert, you only need to make them trust the custom CA once.

Also, some people use the term "self-signed" for any cert that is not trusted-by-default. That usage is wrong, since technically all root-CA certificates are self-signed as well, but it's possible that your tutorial used it this way.

| improve this answer | |
  • So as I understand, I create some certificate, and let someone trusted sign it (or let it sign itself), and then I use this certificate to sign any other certs on my server, and the will be trusted if my first cert was signed by a trusted cert right? In the case the case that my first cert signed itself, and I used it to sign any other certs on my server, I have to add that first cert to my system as a trusted source to make all the other sub-signed certs trusted, if that was right, then I undertood that good as I hope. – Mohammed Noureldin Jan 26 '16 at 16:34
  • If you are creating the certificates then you can't get somebody else to sign it, the certificate is signed, by the identity who creates it. If you are creating your own certificates, then you don't need to sign them, you implicitly trust them because you create them hence they are considered to be (self-signed certificates). In the second part of your comment, both the root and the child certificate would have to be placed into the certificate store, in order for applications and specifically browsers (Chrome and IE) to trust them. – Ramhound Jan 26 '16 at 18:08
  • @Ramhound So you mean if I generated my own private key, and then the public key in csr file, I cannot send it to some CA to let it sign it for me? did you mean so? or I misunderstood? – Mohammed Noureldin Jan 26 '16 at 18:56
  • The public and private key both have to be create by the same identity. Having one signed and the other unsigned wouldn't really accomplish anything from a trust perspective. If you are running services within your own network, and no clients outside of your network are communicating with those services there is no need for a trusted CA to create and sign your certificates since you would implicitly trust your own certificates and have the means to make the OS implicitly trust them also. – Ramhound Jan 26 '16 at 19:12
  • Ok, thank you, actually there will be clients which connecting outside my own LAN. – Mohammed Noureldin Jan 26 '16 at 19:52

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.