2

If I use openssl to create a certificate authority (CA) root (e.g. this blog post or this MDN article) and use it to sign a certificate signing request (CSR), is the resulting signed certificate considered "self-signed" by current desktop PC browsers (Firefox, Chrome, IE)?

Does the answer depend on whether or not the CA root certificate is installed as a trusted authority in the relevant certificate manager?

My understanding is that the answer should be "No, and no." but I have a problem and don't know where my understanding is incorrect.

6
  • This question appears to belong on another site in the Stack Exchange network because its not about programming or development. Perhaps you should try Super User, Information Security Stack Exchange or Crypto Stack Exchange.
    – jww
    Mar 12, 2015 at 23:43
  • "My understanding is that the answer should be "No, and no." but I have a problem and don't know where my understanding is incorrect" - you probably have problems with your DNS names. See this question: How to create a self-signed certificate with openssl?
    – jww
    Mar 12, 2015 at 23:45
  • Wow I did not realize that Stack was so fragmented/siloed. I have my answer. Should I still move the question? Unless someone is really sure, then I'd err on the side of leaving it here so the next person can find out about the other relevant Stack sites. Mar 13, 2015 at 14:24
  • I am trying to make my own CA but am failing with browser errors which, when Googled, always brought up the question "Did you self-sign?". I was pretty sure not (since the CA and the end-entity use different private keys), but did not know for certain and could not find an authoritative answer. I saw that line from Wikipedia but wasn't sure if browsers decided to perceive things differently based on, for example, the organization field. Mar 13, 2015 at 14:30
  • Post the CA cert and the Server cert (end-entity cert). You can do so with openssl x509 -in <cert> -text -noout>. I've never had a problem "becoming my own CA", but I know where a number of landmines lay.
    – jww
    Mar 13, 2015 at 19:21

1 Answer 1

4

According to Wikipedia,

a self-signed certificate is one signed with its own private key.

That is, its creation does not require the signing of a certificate request by a certificate authority. And thus it does not matter whether or not the CA certificate is trusted on the local machine.

EDIT

According to the RFC 5280, Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile:

CA certificates may be further divided into three classes: cross-certificates, self-issued certificates, and self-signed certificates. Cross-certificates are CA certificates in which the issuer and subject are different entities. Cross-certificates describe a trust relationship between the two CAs. Self-issued certificates are CA certificates in which the issuer and subject are the same entity. Self-issued certificates are generated to support changes in policy or operations. Self-signed certificates are self-issued certificates where the digital signature may be verified by the public key bound into the certificate. Self-signed certificates are used to convey a public key for use to begin certification paths.

2

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.