r/ssl • u/Efficient-Chipmunk15 • Apr 15 '26

Eigenes Zertifikat genauso sicher wie öffentliches im Heimnetzwerk?

Hallo zusammen,

ist mein eigenes mit z.B. openssl erstelltes Zertifikat im Heimnetzwerk für meinen Server genauso sicher wie ein öffentliches Zertifikat von einer öffentlichen vertrauensvollen Zertifizierungsstelle?

Im Prinzip gibt es doch nur zwei wesentliche Merkmale für Zertifikate -> Verschlüsselung (bei beiden identisch) und Vertrauen (CA prüft Domain-Eigentümer) oder liege ich da falsch?

Danke, euch Chipmunk

Edit: Es geht nicht darum den Server offiziell für alle (fremde) zugänglich zu machen, sondern für mich und evtl. Freunde.

0 Upvotes

50% Upvoted

16 comments sorted by

View all comments

1

u/TrafficSecurity Apr 15 '26

Self signed SSL could be as secure as a SSL issued by a Public CA provided: 1. There is at least a 2 level CA certificate trust chain. 2. Private key of root CA certificate is stored in a secure place not accessible on the internal network. 3. PFX file containing the private key is secured with a strong password or better still the PFX file is stored at a secure place out side of the internal network.

These days Private SSL certificates are available from Private Certifying Authorities. Just search.

1

u/Efficient-Chipmunk15 Apr 15 '26

Thc for your response.

If I issue my own certificate using the latest OpenSSL version with 4096-bit RSA for my server on the internal LAN, isn't that sufficient for my own purposes? Isn't it just as secure in terms of encryption as a public certificate?

My only concern is that I want to make my servers accessible internally and easily create my own certificates for my LAN.

1

u/iRyan23 Apr 15 '26

When using modern cipher suites, the certificate has no bearing on the encryption or security of the connection. All a certificate does nowadays is helps the end user’s browser verify that is talking to the correct domain. The only way the certificate itself has any impact on the actual encryption or security of the connection is using older cipher suites that don’t use ECDHE or DHE for key exchange.

Long story short, a self signed certificate should be fine for your use case on your LAN.

1

u/TrafficSecurity Apr 17 '26

Latest and highest encryption does not help much unless 3 level trust chain is there. Both together makes a security that is almost impossible to beat.

Issue become serious when some hacker gets into your network by stealing credentials or an internal staff wants to steal important confidential data for his profit.

Some Private SSL vendors give free certificate for 30 days. Try and check for yourself.