What is a self-signed certificate?

Self-signed certificate meaning

In a normal certificate the issuer and the subject are different: an authority vouches for a person. In a self-signed one they are the same, so the holder vouches for themselves. A root certificate is also self-signed, but it is trusted because software was set up in advance to trust it. A self-signed certificate has no such arrangement.

Self-signed certificates and signing documents

A signature made with one proves the document was not changed since signing. It does not prove who signed. Anyone could have put any name in the certificate. For that reason, they do not give the assurance expected of a digital signature certificate from a licensed certifying authority, and they should not be used where a counterparty needs to rely on the signer’s identity. Whether a signature is legally recognised in Nepal is governed by the Electronic Transactions Act, which looks to licensed authorities.

Where self-signed certificates are fine

They are useful in places where the people on both sides know and control the certificate:

• Local development and testing.
• Internal systems where the certificate is added to every machine by an administrator.
• Closed device-to-device links with the certificate stored in advance.

How to spot one

In the certificate details, the issuer and subject are identical and there is no chain above it. A PDF reader reports the signer as unknown or not trusted. Do not click through the warning, and do not install a self-signed certificate as a trusted root unless you created it or the owner of your system gave it to you. See signature validation for how readers reach this result.

Why people still ask for them

Teams often start with a self-signed certificate because it costs nothing and needs no waiting. For prototypes that is reasonable. The problem comes when the prototype becomes the product and customers are asked to click through warnings. Habituating users to ignore warnings makes real attacks easier.

Before going live with anything customers rely on, move to a certificate from a licensed certifying authority. For documents with legal weight in Nepal, that step is not optional under the Electronic Transactions Act.

Example: a contract signed with a self-signed certificate

A freelancer sends a signed PDF using a self-signed certificate with their own name in it. The client’s reader says the signer’s identity is unknown. The client cannot tell whether the freelancer or someone using the freelancer’s name made the signature.

The same freelancer with a certificate from a licensed authority gives the client a statement from a third party that the authority checked the freelancer’s documents. That statement is what the client needs to rely on the signature.

Better options than a self-signed certificate

For internal tools, an organisation can run its own certifying authority and distribute its root to its own devices, which gives a proper chain without public trust. For documents shared with outsiders, the answer is a certificate from a licensed authority.

A self-signed certificate is also sometimes used to sign software in testing. Replace it before release. The cost of a proper certificate is small next to the cost of customers learning to ignore warnings.