Search code examples
securitysslssl-certificateself-signed

self-signed certificates with limited client


Is it safe to use self-signed certificates for my server which will be accessed by limited number of known clients in production? To be more clear , my service is not public like Facebook or Google.


Solution

  • Any certificate the client will accept is 'safe', provided the client isn't insanely programmed to accept any certificate, and unfortunately many are. So whether it's safe in your case depends on how you implement it.

    If you do so correctly, i.e. by distributing the certificate to the client truststores, it is safe. However this distribution is itself a problem, and it recurs every time the certificate expires.

    The truth is that self-signed certificates were always more trouble than they were worth, and now that SSL certificates can be obtained free they aren't worth anything. So every extra step you have to take because it's self-signed is a cost.