SSL Self‐Signed Certificate

Overview

Self-signed certificates are TLS/SSL certificates that are not issued by a trusted Certificate Authority (CA). Instead, they are generated and signed by the users themselves. They are commonly used for internal communications and for setups during development.

• Severity: Medium

Impact

The use of self-signed certificates can expose network communications to interception by unauthorized parties. Since these certificates aren’t trusted by default, they can also lead to trust errors on client applications, reducing user trust in an application or service.

Cause

Self-signed certificates are often used due to their cost-effectiveness or for convenience in development environments, without the need for validation by a CA.

Solution

Replace self-signed certificates with those issued by a trusted Certificate Authority. Ensure proper validation and renewal practices are in place.

Examples

N/A

References

Tenable - SSL Self-Signed Certificate
Let's Encrypt - Free SSL/TLS Certificates
Mozilla Information on SSL Certificates

Additional Resources

SSL Labs' SSL Test -> For Testing the strength of SSL/TLS configuration of a server