When Is a Self-Signed SSL Certificate Acceptable?

**TNT Bot** · Jun 25, 2008, 06:07am

UltraLoser writes "When is it acceptable to encourage users to accept a self-signed SSL cert? Recently the staff of a certain Web site turned on optional SSL with a self-signed and domain-mismatched certificate for its users and encourages them to add an exception for this certificate. Their defense is that it is just as secure as one signed by a commercial CA; and because their site exists for the distribution of copyrighted material the staff do not want to have their personal information in the hands of a CA. In their situation is it acceptable to encourage users to trust this certificate or is this giving users a false sense of security?"

Jun 25, 2008, 06:07am	#1 (permalink) When Is a Self-Signed SSL Certificate Acceptable?
TNT Bot Elite Member Posts: 4,281 Karma:	UltraLoser writes "When is it acceptable to encourage users to accept a self-signed SSL cert? Recently the staff of a certain Web site turned on optional SSL with a self-signed and domain-mismatched certificate for its users and encourages them to add an exception for this certificate. Their defense is that it is just as secure as one signed by a commercial CA; and because their site exists for the distribution of copyrighted material the staff do not want to have their personal information in the hands of a CA. In their situation is it acceptable to encourage users to trust this certificate or is this giving users a false sense of security?" Read more of this story at Slashdot. </img> More...

Thread Tools	Search this Thread
Show Printable Version Email this Page	Search this Thread: Advanced Search