outdated ssl cert

[Steven Stern]

On 01/16/2010 11:21 AM, Craig White wrote:
> On Sat, 2010-01-16 at 17:59 +0100, Vadkan Jozsef wrote:
>> what does a self-signed outdated ssl cert worth? [https]
>>
>> could it be tricked [https] in a way, that the end user will not
>> recognize? [e.g. he already accepted the cert one time, and the browser
>> would warn her, if it been ""attacked""?]
>>
>> ..I mean does an outdated self-signed certificate give the same security
>> as a normal cert?
> ----
> whether 'expired' or 'current', a self-signed certificate offered by a
> web server only has worth if you trust the signer of the certificate and
> you have reason to believe that the certificate being offered is indeed
> the one signed by whoever you believe worthy of the trust. If the
> certificate is expired, it is certain to generate a warning every time
> you encounter it.
> 
> I use self-signed certs all of the time - I trust myself. I have to
> convince other users to trust the certificates that I sign.
> 
> The browser only sees the certificate and knows whether it has been
> signed by an already trusted certificate authority. Some certificate
> authorities are out of the box trusted by your web browser. Many are
> not.
> 
> Craig
> 
> 

Because I have a hard time remembering how to generate self-signed
certs, I set the expiration date for 5 years the last time I had to
create them.

-- 

  Steve