What is difference between self signed and certificate generated by certification authority

Question

Hi, I want to know the difference between self signed and certificate generated by certification authority.

I can easily create a self signed certificate for domain xyz.com then what is the difference between this certificate and the one generated by CA?

Scenario

Suppose a site xyz.com is secured with a certificate issued to xyz.com and it can be accessed by the clients who have the certificate issued by the site.

I can also create a self signed for xyz.com then how will my server take care of this fake certificate?

Answer 1

The CA also does some verification that you are who you say you are, so they add an extra level of confidence when using a site. Self signed cert may not also get a full 'padlock' on a client's browser.

Answer 2

The CA's certificate is already installed in your browser. Then your browser encounters a certificate that claims to be signed by a certain CA it can verify that it was indeed signed by that CA. The CA itself usually verifies your identity in some way or other before signing your certificate.

Your self-signed certificate is just signed by your own CA. No one verified that the certificate actually belongs to the person it claims to belong. You can install your own CA into your browser. That way you won't get those annoying warning messages about the certificate. Other users usually won't have the CA installed and will still get the warning.

Answer 3

There's no difference between the certificates themselves. The important part is that the CA acts as a trusted third party. I.e. the client may not know who you are, but if they trust the CA, and the CA vouches for you, then they can trust you. It is not as much the certificate itself, but the chain of trust the CA provides.

Answer 4

And to complete the other answers the operating system comes preinstalled with some root certificates from Microsoft or other trusted authorities. if your certificate is signed by one of those then no warning will be shown. if a certificate is signed by a CA that the OS does not recognize then it will display a warning.