An SSL certificate is a digital certificate issued by a trusted third-party authority known as a Certificate Authority (CA). It verifies the identity of a website or server and enables secure, encrypted communication.

Components of an SSL Certificate

  • Public Key:
    • Used for encryption and verifying the certificate’s authenticity.
  • Certificate Holder Information:
    • Details like the domain name, organization, and location.
  • Issuer Information:
    • The CA that issued the certificate.
  • Validity Period:
    • Specifies the time frame during which the certificate is valid.
  • Digital Signature:
    • Ensures the certificate was issued by a trusted CA and has not been tampered with.

Self-Signed Certificates

Examples and Differences

TypeUsageExampleDifference
Self-SignedInternal servers, testingGenerated via OpenSSLNot trusted by default in browsers or OS.
CA-SignedPublic-facing serversIssued by DigiCert, Let’s EncryptTrusted by browsers and OS.
Wildcard CertificateSecures a domain and its subdomains*.example.comCan’t be self-signed, requires a CA.
Multi-Domain CertificateCovers multiple domainsexample.com, test.comSelf-signed possible but not widely used.

Self-Signed Certificates

A self-signed certificate is a digital certificate that is not issued by a trusted Certificate Authority (CA) but is signed by the entity it is certifying (e.g., your own server). These certificates are primarily used for internal testing, development environments, or scenarios where external trust is not required.

Characteristics of Self-Signed Certificates:

  • No CA Involvement: The entity creates and signs its own certificate.
  • Limited Trust: Browsers or clients may warn users that the certificate is untrusted.
  • Cost-Effective: Free and straightforward to generate using tools like OpenSSL.
  • Usage: Suitable for testing environments, private servers, or intranet applications.

Types of Self-Signed Certificates

  1. Server Certificates: Used to secure communication for a server (e.g., HTTPS).
  2. Client Certificates: Used to authenticate users or devices to a server.
  3. Code-Signing Certificates: Used to sign software or scripts to ensure they are untampered.
  4. Email Certificates: Used to sign and encrypt emails.

For self-signed certificates, the classification depends on the purpose, not on validation levels like CA-issued certificates.

Examples and Differences

TypeUsageExampleDifference
Self-SignedInternal servers, testingGenerated via OpenSSLNot trusted by default in browsers or OS.
CA-SignedPublic-facing serversIssued by DigiCert, Let’s EncryptTrusted by browsers and OS.
Wildcard CertificateSecures a domain and its subdomains*.example.comCan’t be self-signed, requires a CA.
Multi-Domain CertificateCovers multiple domainsexample.com, test.comSelf-signed possible but not widely used.

How a Certificate File Looks

Certificates are typically encoded in PEM (Privacy-Enhanced Mail) format and look like this:

-----BEGIN CERTIFICATE----- 
MIIC8DCCAdigAwIBAgIUcyDOgjHj0W3... 
...QwMDIxMTgxNzAwWjAfMR0wGwYDVQQDDBQt... 
...eVc1OSn+nnAcAzU2e5/s= 
-----END CERTIFICATE-----

To create a certificate see Creating Openssl Certificate

Breakdown of Certificate Content

  1. Header and Footer:
    • -----BEGIN CERTIFICATE----- and -----END CERTIFICATE-----
    • Indicates the start and end of the Base64-encoded certificate.
  2. Version: Specifies the X.509 version (usually v3).
  3. Serial Number: Unique number assigned to the certificate by the issuer.
  4. Signature Algorithm: Indicates the algorithm used to sign the certificate (e.g., SHA256withRSA).
  5. Issuer: Entity that issued the certificate. For self-signed certificates, it’s the same as the subject.
  6. Validity Period: Contains Not Before and Not After fields, specifying the certificate’s active duration.
  7. Subject: Information about the entity the certificate represents (e.g., domain name, organization).
  8. Public Key: Contains the public key used for encryption.
  9. Extensions: Additional data, such as:
    • Key Usage: Specifies permitted uses (e.g., SSL/TLS).
    • Subject Alternative Name (SAN): Lists additional domains covered by the certificate.
  10. Signature: The digital signature applied by the issuer.