Self-signed certificate
A self-signed certificate is an X.509 certificate where the issuer and subject are the same entity -- it's signed with its own private key rather than by a separate certificate authority, so no chain of trust connects it back to a root a browser or OS already trusts. This makes it cryptographically valid for encrypting a connection but useless for proving identity to a stranger: anyone, including an attacker performing a man-in-the-middle attack, can generate a self-signed certificate for any hostname, so a client has no way to tell a legitimate one from a forged one without some other, out-of-band way of confirming it. Browsers show a hard trust warning for exactly this reason. Self-signed certificates remain legitimate for internal services, local development, and device management interfaces where the client explicitly imports the certificate ahead of time, rather than relying on the public CA trust model at all.
By AdminKit team, Netbase JSC · Updated