Self-signed certificates: legitimate uses, and why browsers reject them
2 min read
What a self-signed certificate is, why browsers warn about it, when it is legitimate on internal networks and why it should never face the public internet — with diagnosis steps.
Definition: an identity with no guarantor
A normal certificate is signed by a certificate authority (CA); browsers trust the certificate because they trust the authority. A self-signed certificate is signed by itself — like approving your own passport in your own handwriting. Encryption still works; what is missing is authentication: nobody vouches that the server is who it claims to be.
That is why browsers show a full-page warning on public sites, and curl fails with self signed certificate. In an SSLx query the chain badge turns red with the reason "self-signed certificate".
When it is fine — and when it is a mistake
For internal test servers, device admin panels (routers, NAS boxes) and development environments, self-signed certificates are practical; you accept the warning knowingly or add the certificate to your trusted store.
On a public website every visitor hits the warning wall — that is lost traffic, and teaching users to click through warnings makes real attacks easier. With free authorities like Let's Encrypt available, there is no longer a defensible case for self-signed certificates on the open web.
The way out
If you own a domain, certbot/Let's Encrypt gives you a free, browser-trusted certificate in minutes. Verify the result with SSLx: the badge should turn green and the chain cards should show the server → intermediate → root flow.
Test your own site
SSLx performs every diagnosis in this guide in ten seconds: chain verification, hostname matching, expiry and HSTS — free, no signup.
Test with SSLxFrequently asked questions
Is encryption weaker with a self-signed certificate?
No; the algorithms are identical. The weak layer is identity: a man-in-the-middle can also mint a self-signed certificate, and the client cannot tell the difference.
What is the right way to avoid warnings on an internal network?
Create your own internal CA, distribute its root to your devices, and sign server certificates with it. Safer and more manageable than adding exceptions one by one.