Self-Signed SSL Certificate Risk
The site uses a self-signed certificate, so browsers warn every visitor and nothing cryptographically verifies the server identity.
What is Self-Signed SSL Certificate Risk?
A self-signed certificate is one you generate yourself instead of obtaining from a Certificate Authority (CA). Because no trusted third party vouches for it, browsers show a full-page "Your connection is not private" interstitial on every visit. Worse, when users are trained to click through that warning, they lose the ability to distinguish your real site from an attacker's lookalike — the warning stops protecting anyone. A certificate's entire job is identity verification plus encryption; a self-signed one provides only encryption between parties who have no reason to trust each other. Since Let's Encrypt made trusted certificates free and automatic in 2016, there is no cost argument left for self-signed on any public host.
Why It Matters to Your Business
The browser interstitial immediately destroys conversion — most visitors abandon at the warning screen, and e-commerce effectively stops. Because self-signed certificates train users to ignore certificate errors, they make subsequent man-in-the-middle and phishing attacks more likely to succeed. Automated integrations (payment gateways, APIs, webhooks) reject self-signed endpoints outright, silently breaking functionality. Security questionnaires and procurement due diligence treat self-signed certificates on production systems as an automatic red flag.
How to Fix It
Get a free trusted certificate from Let's Encrypt: 1. Install certbot on the server: apt install certbot python3-certbot-nginx (Debian/Ubuntu) 2. Issue and install the certificate: certbot --nginx -d yoursite.com -d www.yoursite.com 3. Automated renewal is installed by default; verify: certbot renew --dry-run systemctl list-timers | grep certbot Behind Cloudflare? Switch SSL mode to Full (strict) and Let's Encrypt on the origin is still recommended. Internal-only systems: stand up a small private CA (step-ca, Smallstep) and distribute its root to company devices — that keeps trust internal without browser warnings.
Frequently Asked Questions
Why do browsers show a scary warning for self-signed certificates?
Because the certificate proves nothing. Anyone can generate one for any domain name, so the browser cannot tell your server from an impostor. The warning is the browser honestly saying "this connection is encrypted, but I have no idea who I am talking to."
Can I fix this for free?
Yes. Let's Encrypt issues trusted certificates at zero cost with 90-day automatic renewal via certbot. Most hosting panels (cPanel, Plesk, Cloudflare) also offer one-click free certificates.
Are self-signed certificates ever acceptable?
Only on isolated internal systems where you distribute the certificate through your own private CA and manage trust deliberately — never on anything a public visitor or third-party integration connects to.
Technical Classification
| OWASP Category | A02:2021 — Cryptographic Failures |
| CWE ID | CWE-295: Improper Certificate Validation |
| Detected By | ssl, cert_san scanner(s) |
| Severity Level | high |
How 2MNY Security Can Help
Check if your website has this vulnerability
Our ssl, cert_san scanner checks for this issue automatically.
Scan My Website FreeRelated Vulnerabilities
Weak TLS Cipher Suite
The server negotiates weak TLS cipher suites (RC4, 3DES, CBC, NULL, EXPORT) that are vulnerable to known attacks.
Expired SSL Certificate
The SSL certificate has expired. Browsers show a "Not Secure" warning and may block access to the site.
Weak TLS Protocol Versions (TLS 1.0/1.1)
The server still accepts deprecated TLS 1.0 or TLS 1.1 connections, exposing visitors to downgrade and decryption attacks.