Score:-2

Create Self-Signed Certificate for IP Address (customized domain) on windows

in flag

I want to create a Self-Signed Certificate for an IP Address (not domain) using windows OS.

Then I want to bind this certificate to my API, which is hosted on IIS on our own server. Finally, I want to share a copy of my self-signed certificate with my clients, who will consume my API, so that they can establish a trusted secure connection with my API

Can somebody please advise how to do so?

Lex Li avatar
vn flag
Either you learn how to use PowerShell or use a tool like Jexus Manager, https://docs.jexusmanager.com/tutorials/self-signed.html#background But keep in mind using IP addresses as common names is bad for maintenance (what if IP addresses change?), and asking your clients to use self-signed certificates is also bad for security (why they should trust something insecure?).
in flag
why is it bad to ask my clients to trust my self-signed certificate? what risk does it put them in?
Lex Li avatar
vn flag
A commercial certificate from a real-world certificate authority is mandatory in many business setup, https://en.wikipedia.org/wiki/Certificate_authority A self-signed certificate from you lacks of all those features and protection.
in flag
The two main features of SSL certificates that I know of are: 1) secure the communication between two parties so that a third party doesn't have access to the information being exchanged, and 2) validate the identity of the server to their clients, so that no one can pretend to be the server and get hold of the data which the client intended to share with the server. I understand that asking my clients to install my self-signed certificate is unconventional, and that it is definitely better to use a certificated issued by a Trusted Certificate Authority. However, I don't know why?
in flag
I find that it lets me achieve the two conditions (mentioned above), with only the extra hassle of asking my clients to manually install my self-signed certificate to their list of trusted CA on their systems. Can you please advise what are the risks exactly that I'm putting on my clients by asking them to install my self-signed certificate (issued to my domain), which should only allow them to establish a secure connection with my server?
Martin avatar
kz flag
You should look at it like "hey, look, a third party trusted by you validated the identity of my server, you are really talking to me, not to an attacker". But if you create a CA yourself to verify your identity, your customer looses this assurance. An attacker can do the same steps: Create an CA, sign a server certificate, and tell your customer to trust his CA - and the customer is not able to differentiate between your "valid" CA or the attackers CA...
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.