1. Introduction
In this tutorial, we’ll first define self-signed CA (Certificate Authority) and certificates. Secondly, we’ll review how they function. Then we’ll discuss their characteristics. We’ll also consider some applications for self-signed CAs and certificates. Finally, we’ll discuss the differences.
Self-signed CAs and certificates are brought about by the SSL/TLS protocols. SSL stands for Secure Sockets Layer, and TLS stands for Transport Layer Security. These are protocols and standards for ensuring security and establishing encrypted connections between networked computers. This prevents unauthorized access to information and resources.
The main functions of SSL certificates are to establish encrypted communication and authenticate a user or entity. A website or networked computer without an SSL certificate is vulnerable to cyber-attacks. In addition, users connecting to such a website or computer are at risk of having their information stolen by cybercriminals.
2. Self-signed CA
In simple terms, a self-signed CA is an SSL certificate authenticated by a trusted CA. A CA is an organization whose primary work is to validate the identities of individuals, companies, and any other entity. In addition, a CA is also responsible for issuing digital certificates that bind these individuals and entities to cryptographic keys.
Circling back to self-signed CA’s, it is important to note that users can also have their own private CA’s. However, these have a root certificate issued by well-known and trusted CAs. A company can establish its own CA and validate SSL certificates for use within its company.
2.1. Characteristics of Self-signed CA
The main characteristic of self-signed CAs is that they are issued by well-known and verified CAs. As such, they are trusted by most browsers and users. Most browsers will usually indicate when a website has a trusted CA-issued SSL certificate to notify users. We can spot a closed padlock icon at the top of the address bar of a browser to indicate a secure connection to a website:
A user must pay a subscription or one-time fee to a CA for the service to obtain a self-signed CA. Paying this fee usually comes with some additional benefits, such as handling personally identifiable information by the CA.
Additionally, self-signed CAs have a validity period usually regulated by the CA board. The validity periods are dependent on the CA, but most certificates are valid for two years at a time. This means that after that validity period ends, the user must go back to the CA to re-authenticate the certificate.
Due to the inclusion of a CA, a self-signed CA issued to any user can be revoked if the certificate is being misused or if security is compromised.
2.2. Applications
Self-signed CAs are used in almost every public website available on the Internet today. Having an SSL certificate issued by CA establishes trust between the users of a website and the website’s creators.
3. Self-signed Certificate
Contrary to self-signed CA’s, a self-signed certificate is created and authenticated by an individual or entity themselves without the involvement of third parties such as CAs. Due to the absence of CAs, self-signed certificates are usually signed with a user’s private key. The owner knows these private keys only and cannot be verified.
3.1. Characteristics of Self-signed Certificates
The most notable characteristic of self-signed certificates is they are self-issued. A user creates their certificate and validates it on their own. As a result, these types of SSL certificates have no trust value. Even malicious cybercriminals can create their certificates and validate them themselves.
In the case of websites, most browsers will issue a warning to users when a website is not secure or does not have an SSL certificate. An open padlock indicates a website that is not secured by the browser’s address bar shown as follows or by the “Not Secure”. Additionally, unsecured websites have a URL that begins with “HTTP” as opposed to “HTTPS”:
The absence of third parties in issuing SSL certificates here also means that they can be easily created and issued by users. In most cases, there are application programs that assist users in creating and validating their SSL certificates. For instance, OpenSSL allows users to create their SSL certificates with a few lines of code.
Self-signed certificates are available for free to users over the Internet. There are no fees to be paid to obtain a certificate or authenticate a user’s identity.
Additionally, self-signed certificates have no validity period. A user can use this certificate for as long as they want. There is no renewal or re-authentication of the certificates once it has been created. This contributes to the lack of trust out there for self-signed certificates.
Only the creator of the certificate controls the existence of a self-signed certificate. As such, these certificates cannot be revoked by any third party except the creator.
3.2. Applications
Due to the ease of creating them, self-signed certificates are mostly used in test environments. They are used to test the security of a network or a website. Alternatively, we can use them to establish secure connections between devices for testing purposes.
Self-signed CAs have also found use within intranets owned by companies and organizations.
4. Differences
The major difference between self-signed CA’s and certificates is the certificate’s issuer. These differences can be summed as follows:
Self-signed CA
Self-signed Certificate
Issued by a Certificate Authority
Self-issued
Trusted by browsers
Not trusted by browsers
A fee must be paid to a CA to obtain a certificate
Freely available to users
Valid for a specific period
Valid for as long as the user needs it
Certificates can be revoked by a CA
Cannot be revoked by any party except the user
5. Conclusions
In this article, we defined self-signed CAs and certificates. We’ve reviewed their characteristics, and finally, we discussed the applications of self-signed CAs and certificates in everyday life.
In conclusion, self-signed CAs are considered more trustworthy as compared to self-signed certificates.