Is it a good idea to use cacert SSL certificates instead of self signed one in production?

Question

At work, I have a bunch of web interfaces that use plain http or self signed certificates (load balancer management interface, internal wiki, cacti, ...).

None is reachable from outside specific vlans/networks.

For home usage, I use cacert SSL certificates.

I was wondering if I should suggest my employer to use cacert SSL certificates instead of self signed certificates and plain http. Anyone use cacert ssl in production? What are the pro/cons? Does it improve security? Is it easier to manage? Anything unexpected? Can it affect qualys scans? How can I convince them?

Of course, paid certificates for public websites would remain unchanged.

Edit :

(just curious) Free ssl certificate from companies do not seem to be class 3. I had to show my passport and be present physically to get class 3 from cacerts. Isn't there warning in browsers for each class 1?

Anyway, I would have the same question about any free CA : Is it better than using self signed and plain http, and why ?

I would do it for ease of management, server side. Anything I missed?

Disclaimer : I'm not a cacert association member , not even Assurer, just a regular happy user.

Certificates from different "Class" are not treated any differently in browsers, it's completely on user's side to trust them or not. The only kind of certificates that receive special treatment from browsers are Extended Validation Certificates. — Hubert Kario, Oct 06 '12 at 14:49

score 6 · Answer 1 · edited Oct 03 '12 at 22:29

I would suggest free SSL Certificates from StartSSL, which are recognized by modern browsers too. I've got nothing against CACert except that it doesn't take anything but an account to issue certificates, and those certs are not recognized by anyone unless you manually install the root cert.

_{Obligatory disclaimer as this is a product recommendation: I'm not affiliated with StartSSL in any way. Just a happy customer.}

score 3 · Answer 2 · answered Oct 03 '12 at 22:37

3

Is it better than using self signed and plain http, and why ?

Self-signed certificates will train your users (and YOU) to click through warnings habitually, which is a bad habit. What if that Self-signed certificate was replaced with a rogue certificate? Would your users notice, or would they blindly click through yet-another-security-dialog?

answered Oct 03 '12 at 22:37

Stefan Lasiewski

23,667
41
132
186

I think as long as the self-issued certificates or the root CA is trusted by the client machines/browsers/relevant-software then there will be no warnings in the first place. This means somehow pushing and re-pushing and re-pushing (only when needed, haha) the updated certs to clients. I believe only needs once for a root CA and then only if it changes – Alex Aug 11 '14 at 01:08
Self-signed certs will still trigger a warning, even if they are trusted. But they won't trigger a second warning about trust. – Stefan Lasiewski Aug 11 '14 at 01:15

score 3 · Accepted Answer · answered Oct 04 '12 at 04:45

I would advise that while there's nothing wrong with using free certs, like from CACert, you probably won't gain anything from doing so either.

Since they're not default trusted by anything, you'll still need to install/deploy the root certificate to all your clients, which is the same situation you'd be in with self-signed certs or certs issued by an internal CA.

The solution I prefer (and use) is an internal Certificate Authority and a mass deployment of its root certificate to all domain machines. Having control over the certificate authority you use makes certificate management a lot easier than even through a portal site. With your own CA, you can generally script up a certificate request and corresponding certificate issue so that all your servers, sites, and anything needing a certificate can get it automatically and be trusted by your clients almost immediately after being put into your environment, with no effort or manual tasks by IT.

Of course, if you not up to the task of setting up and automating your own CA, then using an external free one like the one you mentioned could make your life a little easier, only having to deploy one external root certificate... but you should probably try to do it right the first time, and set up an internal CA for your domain.

Setting up internal Certificate Authority is not likely to be done because it costs time to setup, but I believe it's better than free ssl certs. — , Oct 05 '12 at 07:53

Is it a good idea to use cacert SSL certificates instead of self signed one in production?

3 Answers3