title: When is it acceptable to use self-sign cert in production?
body: <p>Self signed cert is always looked down as a test-only certificate. But as per understating, using it for production is perfectly fine if used for the right reason. I am trying to provide some guidelines to my customers about that to use what. E.g.:</p>
  
  <ol>
  <li><strong>Authentication</strong>: Not ok to use self-signed as the Brower will not trust the "self" issuer. So, for service-to-service or service-to-client authentication is not ok to use self-signed. Unless there is a pre thumbprint/CN whitelisting process before verifying. Lot of people do these, e.g. Azure where I upload the management cert public key, which is used to authenticate their API.</li>
  <li><strong>Signing</strong>: No ok, as there is no trust with the issuer. Unless there is a pre thumbprint whitelisting process before verifying. Unless there is a pre thumbprint/CN whitelisting process before verifying.</li>
  <li><strong>Encryption</strong>: Perfectly OK to use self-signed as there no chain trust required. In case of an attack, the MIM cert will simply not decrypt, no other impact.</li>
  </ol>
  
  <p>I would like some thoughts/recommendations/guidelines from the community to ensure my recommendations are in the right direction.</p>
  
  <p>Thanks.</p>