SSL Certificates: internal vs external

[rldoose]

I have searched & read extensively but can't quite figure out a few things:

I have a cert issued by Comodo for my dynamic domain. All works well, and I can access my server both FreeNAS (WAN only) and ownCloud (LAN & WAN) from Chrome and get a green lock status.

However if I use an Internal Certificate, I can never get a green lock and always get the red X over https, the privacy warning, and a message that says ERR_CERT_AUTHORITY_INVALID. Is this just to be expected because I'm not using an external CA? This makes sense to me, yet I'm not secure enough in my knowledge to be sure.... Or am I just doing something wrong in my cert creation?

I have done some reading about using OpenSSL, studied the commands, etc. However, I think that this is what the FreeNAS GUI is using behind the scenes, so why bother with the command line? Is my assumption correct that the FreeNAS GUI is using OpenSSL behind the scenes?

I know my site is secure (Chrome confirms this), and I'm not making the FreeNAS GUI available on the WAN anyway, but I would really like to put all the pieces together just for my own understanding.

Also, as I deploy new tools, it would be nice to be able to generate my own certs using different domain names if I so choose. And since I may make some tools accessible by friends, like I did with ownCloud, I don't want them getting the red X and privacy warnings.....

 

[danb35]

Is this just to be expected because I'm not using an external CA?

Yes. More accurately, it's to be expected when the TLS/SSL certificate isn't signed by a CA that your browser recognizes (some external CAs, like StartSSL IIRC, aren't trusted by default). When you use a self-signed certificate, unless you've explicitly told your browser to trust your own CA, you'll get that error.

so why bother with the command line?

I don't know. What are you hoping to accomplish by using it?

In general, a TLS/SSL certificate verifies two things: (1) the site you're talking to is who you think it is, and (2) communications with that site are encrypted. TLS with self-signed certificates still gives you #2, but not #1.