Disadvantage of using a internal CA issued certificate? Why is it not common?

[chikeungho]

Disadvantage of using a internal CA issued certificate? Why is it not common?

[sw2090 · Accepted solution]

well the main disadvantage of this is that this CA is not trusted by the browsers and systems by default. You will always manually have to install this as trusted ca on every system that needs the verfiy your cert.

Thus there is cases where there is no alternative to that e.g. Deep Packet Inspection (SSL Inspection). This needs a sub-ca or ca cert to work (due to the way it works) which you cannot buy (sub-ca) or afford (ca).

[chikeungho]

Would you recommend?

[chikeungho]

thank you sw2090.

Could anyone give me any example?

would it affect the efficiency of the hardware?

Thanks.

[sw2090]

I do not think it affects the efficiency of the hardware.

If not for SSL Inspection you could use Lets Encrypt or buy a certificate to ensure it is trusted by the browsers by default. This would only affect the FGT Webinterface here though.

For SSL Inspection you need a certificate authority (CA) or a sub CA  because you need a certificate that is able to sign new certificates.

This is because SSL Inspection (Deep Packet Inspection is meant here) works Man in the Middle . (MitM). This means the FGT needs to decrypt encrypted traffic (e.g. https) and then re-encrypt it to hand it on to the client. With re-encryption it needs to keep the Common Name or/and Subject Alternative Name(s) of the certificate the traffic was originally encrypted with. Otherways your Browser would error out because the cert does not match. And it cannot use the original certificate to re-encrypt because that would require having the private key which only the original sender has. 

Plus one advantage of a self-signed cert is that you can set the expiry date free. Letsencrypt only does 2 months e.g. than you have to get a new cert. Most purchaseable certificates are at 1/2 year and then you have to buy a new one.