Understanding SSL: Self-signed vs Certified

0
votes

I'm having a bit of trouble understanding a bit about SSL, namely self-signed vs certified.

First, is my assumption that a self-signed certificate will still prompt the common browser warning message?

Second, data from a https domain doesn't transfer to a http domain, right? So if I had my site at domain.com, and my api at api.domain.com, I would need two certs, and have both of them setup for https?

Last, I noticed there are free SSL certs at sites like StartSSL. This feels fishy, given it can easily cost $100 for a cert at other sites. Am I wrong in being concerned?

1
sslhttps

1 Answers

2
votes

  1. Using a self-signed certificate will cause browser warnings. Your assumption is correct.

  2. It depends; some browsers may warn when this occurs. But you absolutely should serve all of your services on HTTPS, so that clients can authenticate your site(s) and so that the connection is private.

    It is possible to support multiple domains on a single certificate, via the Subject Alternative Name (SAN, subjectAltName) X.509 certificate extension. You could also use separate certificates.

  3. StartSSL is trusted by all browsers; their certificates will be accepted and there is nothing "fishy" about them. You could use StartSSL's free offering to obtain two certificates - one for each domain.

    If you want a single certificate for multiple domains via the SAN extension, you will have to find a product that supports that, and it will probably not be free. The Let's Encrypt initiative is working to change the landscape in this regard, but they have not yet launched.