# Are self-signed certificates on internal servers a problem?

Not because they are self-signed, but because of what usually comes with them. A self-signed certificate encrypts as well as any other; the problem is trust. Clients cannot check it against a known authority, so users and admins learn to click through warnings or switch off verification in scripts, and the same habit lets a real interception go unnoticed. Self-signed certificates on appliances often have weak or default keys, no expiry tracking and no owner. The better pattern is an internal certificate authority, issuing through automation where possible, whose root is distributed to managed devices, with an inventory of every certificate and its expiry. For devices that only ship with self-signed certificates, such as printers or controllers, replace the certificate where the device allows it and keep the device in a segment with restricted access. Self-signed certificates also belong in your post-quantum inventory: each has a key type and size that will need to change one day.

FAQ: [Encryption and encrypted traffic](https://netsenx.com/en/faq/encryption) · https://netsenx.com/en/faq/are-self-signed-certificates-on-internal-servers-a-problem

## Read next

- https://netsenx.com/en/encrypted-traffic-analysis
- https://netsenx.com/en/what-is-ndr

## Related questions

- [What is mutual TLS (mTLS)?](https://netsenx.com/en/faq/what-is-mutual-tls)
- [Does a VPN encrypt everything we send?](https://netsenx.com/en/faq/does-a-vpn-encrypt-everything-we-send)
- [How do I find all SSH servers on our network, including forgotten ones?](https://netsenx.com/en/faq/how-to-find-all-ssh-servers-on-the-network)
- [How do I check which servers run an OpenSSH version affected by a new CVE?](https://netsenx.com/en/faq/how-to-check-openssh-versions-against-a-new-cve)
- [Does an SSH version banner prove a server is vulnerable?](https://netsenx.com/en/faq/does-an-ssh-version-banner-prove-a-server-is-vulnerable)