In cryptography and computer security, a self-signed certificate is an identity certificate that
is signed by the same entity whose identity it certifies.
This term has nothing to do with the identity of the person or organization that actually
performed the signing procedure.
In technical terms a self-signed certificate is one signed with its own private key.
In typical public key infrastructure arrangements, a digital signature from a certificate authority
attests that a particular public key certificate is valid.
Users, or their software on their behalf, check that the private key used to sign some
certificate matches the public key in the CA's certificate.
Since CA certificates are often signed by other, "higher-ranking," CAs, there must necessarily
be a highest CA, which provides the ultimate in attestation authority in that particular
PKI scheme.
Obviously, the highest-ranking CA's certificate can't be attested by some other higher CA,
and so that certificate can only be "self-signed."
Such certificates are also termed root certificates.
Clearly, the lack of mistakes or corruption in the issuance of such certificates is critical
to the operation of its associated PKI; they should be, and generally are, issued with
great care.
In a web of trust certificate scheme there is no central CA, and so identity certificates
for each user can be self-signed.
In this case, however, it has additional signatures from other users which are evaluated to determine
whether a certificate should be accepted as correct.
So, if users Bob, Carol, and Edward have signed Alice's certificate, user David may decide
to trust that the public key in the certificate is Alice's.
But, if only user Bob has signed, David might decide to take additional steps in evaluating
Alice's certificate.
On the other hand, Edward's signature alone on the certificate may by itself be enough
for David to trust that he has Alice's public key.
There is of course, a potentially difficult regression here, as how can David know that
Bob, Carol, or Edward have signed any certificate at all unless he knows their public keys?
In the case of a small group of users who know one another in advance and can meet in
person, users can sign one another's certificates when they meet as a group, but this solution
does not scale to larger settings.
This problem is solved by fiat in X.509 PKI schemes as one believes the root certificate
by definition.
The problem of trusting certificates is real in both approaches, but less easily lost track
of by users in a Web of Trust scheme.
Security Issues CAs are third parties and require both parties
to trust the CA.
If the parties know each other, trust each other to protect their private keys, and can
confirm transfer public keys, then self-signed certificates may decrease overall risk.
Self-signed certificate transactions may also present a far smaller attack surface.
Self-signed certificates cannot be revoked, which may allow an attacker who has already
gained access to monitor and inject data into a connection to spoof and identity if a private
key has been compromised.
CAs on the other hand have the ability to revoke a compromised certificate if alerted,
which prevents its further use.
Some CAs can verify the identity of the person to whom they issue a certificate; for example
the US military issues their Common Access Cards in person, with multiple forms of other
ID, and only when a higher authority requires the issue.
Other Issues Cost Self-signed certificates can be created
for free using a wide variety of tools including Java's keytool, Adobe Reader, and Apple's
Keychain.
Certificates bought from major CAs often cost around a hundred dollars per year.
Speed to Deploy Self-signed certificates require the two parties to interact.
Using a CA requires only the CA and the certificate holder to interact; the holder of the public
key can validate its authenticity with the CA's root certificate.
Customization Self-signed certificates are easier to customize, for example a larger
key size, contained data, metadata, etc.
See also Digital signature
Certificate server Characters in cryptography
References
Terminology C
Country CA
Certificate authority CN
Common Name CSR
Certificate signing request DER
Distinguished Encoding Rules O
Organization OU
Organizational Unit External links
http:www.selfsignedcertificate.com http:www.mobilefish.comssl_certificates/ssl_certificates.php
http:makecert.comcreate-self-signed-ssl-certificate/
http:www.yasinkaplan.com/tekcert.asp