Are SSL's default snake oil certificates truly snake oil as opposed to being genuine honest-to-good certificates? [closed]

Question

SSL generates self-signed "snake oil" certificates by default, for example at /etc/ssl/certs/ssl-cert-snakeoil.pem. As per Wikipedia, snake oil is a cryptographic method or product that is considered fraudulent or bogus. Is there anything bogus about these certificates? Sure, they aren't signed by any known certificate authority, but the certificates themselves could still be genuine certificates as good as any other. For example, I might be distributing my server's public key to all my clients securely in person. Assuming this, is there anything snake-oil-worthy of the generated certificates, or is the name misleading?

Answer 1

Remeber SSL serves two very important functions

1. Secure communication
2. Trust

Any self generated SSL certificate give you 1. which allow encrypted traffic or as you say a valid SSL certificate.

However a self-generated SSL certificate can only give Trust to people who trust you. The reason for SSL certs being generated by trusted 3rd parties is to provide number 2. Your browser trusts them and they trust you. If you generate it yourself you could claim to be www.microsoft.com and if someone trusted you it would be.

Also as pointed out in the comments this is why you shouldn't trust someones self signed cert for their server as then your browser will apparently trust any future certificates signed by the same server.

This is why self - generated are snake oil certs.

Update: The LetsEncrypt service coupled with a modern webserver such as Caddy take almost all the difficulty out of getting and using TLS certs, so no need for snake oil certs any more!

Answer 2

Self-signed certificates will encrypt your communication just the same as standard ones. So the encryption is not the issue.

Certificates can also be used to verify identity. How it is supposed to work is that when you connect securely to a server, that server presents its certificate to you or your browser, and then you or your browser decide if you can trust the server's assertion of identity.

Certificates can be signed by other "higher-level" certificates, typically called certification authorities. So, if the server's certificate is signed by a CA that you or your browser trusts, the identity is considered valid.

Most major browsers come with a number of root certificates that they automatically trust, from Verisign and other well-known CAs.

With a self-signed certificate, since it is not signed by a third-party CA but the same entity that made the certificate, you cannot depend on anyone else to verify the identity except the one who generated the certificate. It's equivalent to someone printing their own ID card and giving it to you to verify identity. This isn't necesarily a problem, despite browser warnings, if you know/trust who generated the certificate or did it yourself.

Answer 3

Wikipedia also says: "Snake oil is an expression that originally referred to fraudulent health products or unproven medicine but has come to refer to any product with questionable or unverifiable quality or benefit".

It's the unverifiable quality that's important in this context. If you browse an SSL site that doesn't have a certificate chain to a trusted Certificate Authority then you can't rely on SSL to verify that the site is owned and operated by the person or organization that owns the domain (as displayed in your browser's url bar).

Modern web browsers display a security warning when browsing sites with self-signed ("snake oil") certificates because they lack this trusted certificate chain. This can be annoying on a private Intranet, for example, but it does go some way to protect people from entering their private data and payment information into phishing sites.