self-signed certificate : Java Glossary

The hassle with using phony certificates is that they must be manually pre-installed on all the client’s machines before your signed Applets will be recognised. With real certificates, that step is not necessary. The built-in signing authority root certificate suffices. It is pretty awkward to pre-install certificates for the general public. Phony certificates are more feasible for strictly in-house use.

In theory, a self-signed certificate should suffice to authenticate code on your own website. Who else could have created the certificate? The need for validation only really comes into play verifying code floating about the net purportedly from you. A real certificate allows that verification, even without checking in any way with your website. In contrast, a digital signature with a phony certificate proves absolutely nothing.

Most users don’t understand even the most basic facts about certificates. They are thus overly frightened of self-signed certificates. So you will likely end up buying a real one eventually.

See signtool or keytool for details of how to create a phony certificate.

To create phony SMIME email authentication certificates in Windows use:

Why You Want A Real Certificate

• A phony certificate gives no more protection than an unsigned Applet would have. It gives only the illusion of identification and security. The only time it has any security at all is when the certificate has been imported into the cacerts. or certificate repositories of all your clients by some secure means. It is easy to forge a phony certificate with any company’s name on it that you please. Unfortunately, the general public is unaware of this, and treat phony certificates with too much esteem. Phony certificates should be trusted equally to unsigned Applets. This is the reason I call them phony certificates rather that the exalted self-signed certificate. They are logically equivalent to forged certificates. On the other paw, I sign my Applets and Jawa Web Start apps with a phony certificate because I cannot afford a real one.
• You don’t have to install your real certificate on client machines. The "factory "-installed authority root certificate suffices.
• There is no way to automatically install a phony certificate on the machines owned by the general public. You have a catch-22. You need permission to install the certificate on local hard disk, but you need the installed certificate to get permission.
• Phony certificates are only suitable for in-house use or for testing while you wait for your real one to arrive.
• The public is less likely to trust a phony certificate and may refuse to run your Applet.
• Similarly customers may refuse to use your secure connection with a phony SSL certificate. If you are too cheap to buy a cert, can you really be trusted with credit card numbers? Why don’t you want to present your id? You are advertising yourself as fly-by-night and Mickey Mouse. I have devised a scheme for secure transmission that does not rely on SSL certificates. See the Transporter.
• You may accidentally give away your private key if you go around installing your certificate on many machines. I know of no way to export a certificate from Netscape without including your private key.