Certificates & Formats
What Is Self-Signed Certificate?
A self-signed certificate is signed by the same key it contains, rather than by a certificate authority — the issuer and subject are identical. Nothing vouches for it, so browsers warn loudly. That makes self-signed certificates fine for labs and internal experiments, legitimate as trust-store-distributed roots, and a chronic source of risk when they accumulate in production.
Legitimate uses
Every root CA certificate is technically self-signed — trust comes from deliberate distribution into trust stores, not from the signature. Development environments, appliances’ first-boot certificates and isolated lab setups are also fair uses: the cost of PKI ceremony there exceeds the risk.
Why they are a problem in production
Self-signed certificates train users and admins to click through TLS warnings — which neutralizes TLS as a defense, because a real man-in-the-middle produces exactly the same warning. They also escape every lifecycle process: no CA record, no expiry monitoring, no revocation. Years later they surface as unexplained certificates on port 443 of something important.
The better pattern for internal services is a small private CA (ADCS or a minimal offline-root setup): one root distributed via Group Policy/MDM, and ordinary, monitorable certificates for every service — warnings stay meaningful, and inventory stays possible.
Try it yourself — free tools
- Certificate Checker — identify self-signed certificates and what they claim
- CSR Generator — take the first step toward a properly issued certificate instead
How MI Support IT can help
PKI Tools is built by MI Support IT, a Danish IT company with deep specialization in enterprise PKI: ADCS design and health checks, Venafi certificate automation, key ceremonies and CP/CPS documentation. Read about our PKI services or get in touch.
PKI Glossary
- Certificate Authority (CA)The trusted organization that issues and signs digital certificates — and the root of every trust chain.
- Trust Store (Root Store)The list of root CAs a system trusts — where it lives per platform, and how to manage your own additions.
- Certificate Chain (Intermediate Certificates)How leaf, intermediate and root certificates link together — and why a missing intermediate breaks TLS.
- Browse all terms →