Do I need a SSL Certificate for an Intranet application

Question

My application will be deployed to the user's server with an MSI installer, and the expectation is that it will run as an intranet application on their secure network.

However, as I'm using HTTPS on the entire site, I'm wondering how I can get a valid certificate.

I've generated a Dev one using MakeCert, but have no idea how to do this for Production.

I don't particularly mind about the verification side of the SSL, I just want the communications for the app to be encrypted.

I'd appreciate your thoughts/guidance with this.

Thanks!

Answer 1

This completely depends on your standards and your paranoia. According to that you have a couple of options

No HTTPS:

• No green mark
• No server authentication / prevention of man-in-the middle attacks
• No prevention of "stand by" sniffing

Self Signed Certs:

• The user need to "approve" the cert at least once (this is something where you have to guide your user through one by one, as most "normal" users dont handle it)
• No server authentication / prevention of man-in-the middle attacks
• At least some prevention of "stand by" sniffing

Domain signed Cert: (when you are in a company, you usually have a domaincontroller and where you already have or can install a CA and sign certificates)

• Costs nothing
• Server authentication
• Prevents "stand by" sniffing
• Users outside your domain, still need to approve manually this certificate

Free certificate (letsencrypt.com): (There are free authorities, where you can get certificates from. As a dependency you need to buy a valid domain, host your site under this domain, and either make the server public available (HTTP01 challenge) or use a SSL certificate provider with a supported API (DNS01 challenge))

• Costs nothing
• Server authentication
• Prevents "stand by" sniffing
• Everybody, in and outside your company's domain trust those certs

Buy a certificate (namecheap comodo, like 9$ per year): (you need to create a a private key, then a CSR, send the CSR to the authority and get the normal cert back, which you then can install on your server with your private key)

• Costs a little
• Server authentication
• Prevents "stand by" sniffing
• Everybody, in and outside your company's domain trust those certs

Hope this helps. Its by far not complete yet should give you some overview

Answer 2

You can just generate one for free. It's best if say you have a domain controller, DNS, and certificate server if you are a Microsoft shop.

Here's an article https://technet.microsoft.com/en-us/library/cc995096.aspx