Quote:
Originally Posted by digitalnerds
I am afraid i still sustain my opinion and i am NOT ashamed of myself for suggesting this. I see nothing backwards in terms of security as, again, it is being used for encryption rather than identification.
By all means if he bought a valid cert for this very purpose then he should use it. But if he bought a single cert that he can use for web instead of mail then he should generate a self-signed one. That's what i would do anyway.
Regards
|
THERE IS NOT POINT IS HAVING ENCRYPTION IF IT'S NOT AUTHENTICATED. I don't know how much more clear I can be. Yes, it
is a step backwards in security, because without authentication the connection is dead-simple to attack and the encryption is meaningless because the data can be sent anywhere (ooh, but it will be encrypted all the way to the Russian mafia's botnet, so it will be really secure as they steal it!).
If you don't understand what certificates are for, kindly refrain from talking about them.
By the way, to show how ignorant you are there are not separate certs for web servers vs. e-mail servers. A server cert is a server cert. There are some special extensions that deal with other aspects (such as code-signing, revocation, etc) but those are extended attributes and don't come into play in this case. You can absolutely use a "web server cert" for an e-mail service as long as the hostname is the same (which it certainly appears to be in this case).
And to answer the question,
YES your users
will get security warnings if you use a self-signed cert, and for good reason:
IT'S INSECURE!
Just simply scrambling data is not "dust your hands, you're all secure and done" security. It matters
who can
unscramble the data, and unless you're authenticating the connection, that means
anyone can pretend to be you and unscramble it. So tell me, what is the point of encrypting something if anyone can decrypt it?
Just because you read blogs from half a dozen security-illiterate, lazy, careless, and uninformed web developers doesn't mean they're right. The Mozilla dev team is correct, and all the people crying about self-signed certs are dead wrong. Self-signed certficates are not security, they're
false security that will lie to users and trick them into surrendering data that they should not have sent because it isn't actually protected. That is worse than no encryption, because at least with no encryption you
know you aren't protected.
PS for sin0nyx, no there is nothing stopping someone from using a certificate for both Sendmail and Apache.
PPS digitalnerds, just because you would do something doesn't mean it's smart, and certainly doesn't mean someone else should do it. That's a terrible justification for giving any advice, especially when you clearly don't understand how TLS and X.509 are designed to work (let alone basic security principles).