OPENSSL X509 INSTALL

The next best way to avoid the browser warning is to trust the server's certificate. Steps 1 and 5 allows you to avoid the third-party authority, and act as your own authority (who better to trust than yourself?). Steps 2 - 4 are roughly what you do now for a public facing server when you enlist the services of a CA like Startcom or CAcert. Then, import your CA into the Trust Store used by the browser. To become your own certificate authority, see * How do you sign a certificate signing request with your certification authority? on Stack Overflow. That means the Subject and Issuer are the same entity, CA is set to true in Basic Constraints (it should also be marked as critical), key usage is ke圜ertSign and crlSign (if you are using CRLs), and the Subject Key Identifier (SKI) is the same as the Authority Key Identifier (AKI). Step 1 - Create your own authority just means to create a self-signed certificate with CA: true and proper key usage.

OPENSSL X509 INSTALL

Install the CA certificate on the client.

Install the server certificate on the server.

Create a certificate signing request (CSR) for the server.

Create your own authority (i.e., become a CA).

A self-signed certificate does not chain back to a trusted anchor. This is because browsers use a predefined list of trust anchors to validate server certificates. The site's security certificate is not trusted! This is probably not the site you are looking for! It's easy to become your own authority, and it will sidestep all the trust issues (who better to trust than yourself?).

But I would encourage you to become your own authority. In the absence of becoming your own authority, you have to get the DNS names right to give the certificate the greatest chance of success. So the complete solution is to become your own authority.

In fact, you can't with some browsers, like Android's browser. Some browsers don't exactly make it easy to import a self-signed server certificate.

And browsers are actively moving against self-signed server certificates. Modern browsers (like the warez we're using in 2014/2015) want a certificate that chains back to a trust anchor, and they want DNS names to be presented in particular ways in the certificate. The restrictions arise in two key areas: (1) trust anchors, and (2) DNS names. The requirements used by browsers are documented at the CA/Browser Forums (see references below). It's difficult because the browsers have their own set of requirements, and they are more restrictive than the IETF. It can be tricky to create one that can be consumed by the largest selection of clients, like browsers and command line tools. It's easy to create a self-signed certificate. Am I missing something? Is this the correct way to build a self-signed certificate?

Openssl x509