Re: CA-SSL in IIS

On Tue, Jul 15, 2003, Ed Sunder wrote:

> What drawbacks are there in becoming your own certificate

You need to maintain a strict security support structure to protect your certifice service servers, root CAs, intermediary CAs and so forth. ISS wrote up some guidelines in their MS Press Windows 2000 Security Technical Reference. In theory. People producing their own X.509 certs for private use seldom take such measures. But at the end of the day, how much you effort you should make depends on your security requirements.

You need to distribute your root CA certficate to your users' browsers - so they aren't faced with the "This cert is not signed by a valid CA" warning. But this can be accomplished via Group Policy IIRC.

Otherwise, private CA's are pretty common I reckon.