CyberCertPrepWeb App FundamentalsHTTP & Web BasicsEASYFree question
A HTTPS site uses a self-signed certificate. A developer argues this is fine since 'the traffic is still encrypted'. What critical protection does a self-signed certificate LACK compared to a CA-signed certificate?
- A.A self-signed certificate provides no third-party verification of the server's identity; an attacker performing a MITM attack can present their own self-signed certificate and users have no way to distinguish the real server from the attacker's interception proxy
- B.Self-signed certificates use weaker encryption algorithms
- C.Self-signed certificates cannot use TLS 1.3
- D.Self-signed certificates do not encrypt data in transit
Why A is correct
HTTPS provides two things: encryption and authentication. Encryption protects data in transit; authentication proves the server is who it claims to be. A self-signed certificate provides encryption but no authentication - any attacker can generate their own self-signed cert for any domain. Without a trusted CA chain, the browser cannot verify the server's identity, and users who click through certificate warnings are communicating securely with an unknown party.
Know someone studying for Web App Fundamentals? Send them this one.