1

I just set up a NAS cloud (WD MyCloud EX2) and I access to it via local network and https WebDAV for remote locations, as mobile phones and computers. My IP is Dynamic, so I use DynDNS.

The problem is that I mounted it in Cyberduck and it told me that there is a problem with the certificate, that it is not valid, and that someone could impersonate the identity of the server. Do you think that can easily happen? I don't mind if it is not FBI-proven, I just want that not every low-level hacker can access to my data.

Thank you

Certificate Error WebDAV screenshot

1 Answer 1

2

HTTPS performs two functions:

  • Verify the identity of the server (Basic proof of domain ownership is sufficient enough, for sites involved in financial transactions further verification is required)
  • Encrypt the transmitted data

A signed certificate from a Certificate Authority performs both of those.

A self-signed certificate only provides the functionality of encrypting the data. As a result, connections to a server with a self-signed certificate will give a security warning. That's what I think might be happening to you.

A self signed certificate isn't as secure as a signed one, but more secure than plain http without encryption. Normal HTTP connections don't usually give security warnings (some password prompts give warnings) implying that self signed certificates are less secure, but this is not the case and as long as you can verify by other methods you are connected to the correct server, you should be safe.

If it's a server you have accessed over localhost (you cannot get a certificate for localhost or local addresses, but you can get them for domains and use DNS to map those domains to local IPs) you can ignore these warnings and proceed and you will know it's your machine. Once you set it up you can configure it in a unique way so that when you connect from outside and accept the certificate you can know you are connected to your server. Ex. you see the same files you put there on a different connections.

If you accepted the certificate before and the server certificate changes (like if if expires) you will get the warning again and that's normal. If you are sure the certificate has not changed since you last accepted it and get another prompt that might be an issue there.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .