Self-Signed Production Certificate

Question

We have a GlassFish Java EE project that contains a login screen that we want to protect through SSL.

What is the disadvantage of using a self-generated certificate instead of one signed from a CA in production? Will he give warnings and bad experience to the end user?

Answer 1

Yes, a user viewing a login site receives a warning about his certificate in his browser each time.

If the application will be used only in a closed group of users (say, inside the company), you can reduce this by adding a self-signed certificate to each user set of trusted certificates (either in the browser or on the OS, depending on the specific situation).

But if your application is usually open to the general public, then he considers it a bad practice to use self-signed certificates. You basically train your users to ignore and accept a browser warning, which is usually the last line of defense against man-in-the-middle attacks. This is clearly not what you want, so in this case you should always use a “real” certificate, even if it is only a deployment for deployment / testing.