✎ [V8] FAQ: Should you use the default Ahsay dummy / self-sign certificate for your business? [Ahsay Wiki]

This page is read only. You can view the source, but not change it. Ask your administrator if you think this is wrong.
===== [V8] FAQ: Should you use the default Ahsay dummy / self-sign certificate for your business? =====

<html>
 <b>
  Article ID:
 </b>
 8037
 <br/>
 <b>
  Reviewed:
 </b>
 2019-03-27
 <br/>
 <br/>
 <b>
  Product Version:
 </b>
 <br/>
Ahsay Software: 8.1 to 8.x
<br>
OS: All platforms 
</html>


===== Description =====
Should you use the default Ahsay dummy / self-sign certificate for your business? 


===== Contents =====
<html>
The Ahsay dummy / self-sign certificate, which is bundled with every AhsayCBS installation by default, is a handy tool to have, but using it for a production backup server could be a big mistake.<br><br>

Here's when it makes sense and when it doesn't. <br><br>

<b><u>For a public facing backup server</u></b><br>
For any public-facing backup server (WAN environment), it is <u>never</u> a good idea to deploy your AhsayCBS with the default Ahsay dummy / self-sign certificate. &nbsp;That is, even if you have never suffer a security / cryptographic attack of any sorts, you must put forth a very trustworthy front for your customers, as the slightest security misstep could be catastrophic to your company’s image.<br><br>

Does this look like a trustworthy website to you?<br><br>

<img style="width:75%" src="http://wiki.ahsay.com/lib/exe/fetch.php?media=public:dummy_cert.png"/>
<br>
<br>
 
While the default Ahsay dummy / self-sign certificate also encrypt customers' data and other account credentials, most browsers such as Google Chrome and Mozilla Firefox will display a security alert because the default Ahsay dummy / self-sign certificate was not verified by a trusted Certificate Authority.<br><br>

The security warnings associated with the default Ahsay dummy / self-sign certificate may drive away potential customers with fear that the website does not secure their credentials and data. &nbsp;Both brand reputation and customer trust are damaged.<br><br>

<b><u>For an internal facing backup server</u></b><br>
For internal backup server (LAN environment), the default Ahsay dummy / self-sign certificate should only be used on a temporarily base (e.g. proof of concept phase), or for testing purposes.<br><br>

Many organizations advise internal users to simply ignore the warnings since they know the internal web console is safe, but this could encourage dangerous public browsing behavior. &nbsp; Internal users accustomed to ignoring warnings on internal sites may be inclined to ignore warnings on public sites as well, leaving them, and your organization, vulnerable to malware and other threats (e.g. open to man-in-the-middle attacks).<br><br>

To conclude, the simple fact is, the default Ahsay dummy / self-sign certificate should only be used for temporarily internal LAN-only services, or for testing purposes.<br><br>

For any other setup, it is strongly recommended to install a trusted SSL certificate for your backup service.<br><br>

Note:<br>
For instruction on how to install a trusted SSL certificate for your AhsayCBS server, refer to the instruction provided in the <a href="http://download.ahsay.com/support/document/v8/guide_cbs_admin_v8.pdf">AhsayCBS Administrator’s Guide</a>. &nbsp;<a href="http://wiki.ahsay.com/doku.php?id=public:8028_faq:trusted_ca_list_for_v8">Click Here</a> for the list of Ahsay trusted CA. &nbsp;Alternatively, you can also let our professional service team to help you with the SSL certificate CSR generation and SSL certificate installation.  <a href="https://shop.ahsay.com/sms/catalogue/ListOffers.do?currentGroup=Installation%2c+Upgrade+and+Support+Services">Click Here</a> to visit the Ahsay Shopping Centre for subscription.<br><br>

Please note that it is not Ahsay System’s obligation to renew a dummy certificate since the default Ahsay dummy / self-sign certificate is only intended for functionality testing purposes.
</html>



===== Keywords =====
ahsay, self, sign, selfsign, self-sign, cert, certificate, ca, dummy, default, security
User Tools

Site Tools

Page Tools
