Smarter by Design.Simpler for Business
TR7Enterprise Application Delivery & Security Platform
What is a self-signed certificate?
Short answer
A self-signed certificate is a certificate signed with its own private key instead of by a CA; the issuer and the subject are the same. Since the chain does not reach a trusted root CA, browsers show a warning, but the connection is still encrypted; for this reason it is used not on sites open to the internet but in the internal network, in test environments and on application servers. In TR7, self-signed certificates are encountered most often on the Backend Service side: since Certificate Verification is None by default, TR7 accepts the self-signed certificate of the Backend Service without verifying it; if verification is wanted, Required is selected and the certificate itself is selected as the trusted CA in the Verification CA Profile field.
Where It Is Used in TR7
| Where | Field / label | What for |
|---|---|---|
| Backend Service → SSL Service | Certificate Verification: None (default), Required | Whether or not to verify the Backend Service certificate |
| Backend Service → Certificate verification = Required | Verification CA Profile | The CA record that will verify the certificate; the self-signed certificate can be added as this record |
| Certificates & PKI → Certificate Authorities (CA) | Add a trusted CA certificate | Adding the self-signed certificate, or the corporate CA that signs it, as a trusted record |
| Load Balancer → Profiles (L4-L7 Behavior Sets) → Health Checks | Verify Server Certificate (off by default) | Verifying the server certificate in health checks that use TLS |
| Certificate Authorities (CA) → Create Root CA | Internal Root CA | The root CA certificate generated in TR7 is also self-signed |
Common Misconceptions
- "A self-signed certificate does not provide encryption." It does provide encryption; what is missing is the confirmation of the identity by a trusted CA.
- "TR7 cannot connect to a Backend Service with a self-signed certificate." With the default None setting, it connects; when Required is selected, it still connects if the certificate (or the CA that signs it) is selected as the Verification CA Profile (My backend uses a self-signed certificate; is that a problem?).
- "Selecting Required turns on verification by itself." If no Verification CA Profile is selected together with Required, no verification is performed (Can I verify the backend certificate when connecting to the backend over HTTPS?).
How it is done in the documentation
