MicrosoftDocs
"Self-signed" does not mean "self-issued"
A self-signed certificate is one that is it's own Root CA: it is it's own signatory; it is simultaneously a leaf and root, and there is no certificate chain. This article and others like it are sources of endless confusion for the inexperienced.
Please correct your use of "self-signed." You either create a self-signed certificate with no chain, or you create your own root CA and sign leaf certificates. In the latter, the Root CA is self-signed because this is how Root CA's work; commercial and in-house Root CA certs are self-signed. The leaf certificate is either self-signed (it is it's own Root CA) or it is signed by a commercial or private Root CA.
You are conflating self-signed (cert signs itself) and self-issued (I did it myself):
https://en.wikipedia.org/wiki/Self-signed_certificate#Name_Confusion
Deeper explanation of a self-signed certificate: https://revocent.com/resources/what-is-a-self-signed-certificate-and-how-does-it-work/
Document Details
⚠ Do not edit this section. It is required for learn.microsoft.com ➟ GitHub issue linking.
- ID: 3b0e716d-54fc-0b48-e2aa-9f5b126072ae
- Version Independent ID: cda1facc-d299-a154-e824-a1b695f812d8
- Content: Generate self-signed certificate with a custom root CA - Azure Application Gateway
- Content Source: articles/application-gateway/self-signed-certificates.md
- Service: application-gateway
- GitHub Login: @greg-lindsay
- Microsoft Alias: greglin
Please see this thread as to why this is problematic:
https://github.com/MicrosoftDocs/azure-docs/issues/44425#issuecomment-564634256
@oising Thanks for your feedback! We will investigate and update as appropriate.
@Naveenommi-MSFT @ManoharLakkoju-MSFT
You are conflating self-signed (cert signs itself) and self-issued (I did it myself):
https://en.wikipedia.org/wiki/Self-signed_certificate#Name_Confusion
Deeper explanation of a self-signed certificate: https://revocent.com/resources/what-is-a-self-signed-certificate-and-how-does-it-work/
@oising I'm going to assign this to the document author so they can take a look at it accordingly
@greg-lindsay Could you Please review this and update as appropriate.
Hi @greg-lindsay
In short, when we self-issue a cert, we have two choices:
- create a root CA cert (which has no parent cert, so it must be self-signed) and use this to sign leaf nodes (i.e. used for SSL) - ergo the leaf node is self-issued, but not self-signed; it has been signed by the root CA cert.
or
- create a leaf node (self-issued) and use it to sign itself, ergo it is self-signed
Both cases are self-issued, but only case (2) has a self-signed leaf certificate.
This could be dismissed with a hand-wave as not that important until you realize that certain products in the Microsoft catalogue (e.g. AppGw backends) only function when case (1) is used. Case (2) is not supported and causes hard to diagnose issues.
@oising we are looking at the terminology and will update as appropriate. Thanks for the feedback. I'm sorry this is taking a long time.
