是否可以使用 https（自有服务器）而无需支付任何费用？
我想使用 SSL (https) 来保护通信。 是否可以在不购买某种证书的情况下做到这一点？
I want to use SSL (https) to secure communication. Is it possible to do it without buying a certificate of some sort?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（3）
您可以使用自签名证书（谷歌搜索），但您的用户将收到一条消息，指出该证书无效。 但是，流量仍将被加密。
您必须向第三方支付“有效”SSL 证书的费用是因为 SSL 证书的部分目的是验证服务器的真实性。 如果任何机构都可以使用他们想要的任何信息颁发 SSL 证书，那么什么可以阻止我使用 Walmart.com 的联系信息设置 SSL 证书并欺骗用户认为我的网站是 walmart.com 的分支机构？
简而言之，您可以免费获得加密部分，但如果您想避免浏览器身份警告，则需要支付第三方证书的费用。
You can use a self-signed certificate (google it) but your users will get a message saying the certificate is not valid. The traffic will still be encrypted, however.
The reason you have to pay a third party for a "valid" SSL certificate is that part of the purpose of an SSL certificate is to verify the authenticity of your server. If any body could issue an SSL cert with any information they wanted, what's to prevent me from setting up an SSL certificate using Walmart.com's contact information and tricking users into thinking my site is a branch of walmart.com?
In short, you can get the encryption part for free, but if you want to avoid browser identity warnings, you'll need to pay for a third party cert.
您可以自行签署证书，或从cacert.org 或相关的免费签名社区。 大多数浏览器都会发出警告，因此您不应该在生产中这样做（如果您是电子商务企业），但在开发过程中，或者如果您不关心警告，那么这是一个便宜的替代方案
You can self sign a cert, or get one from cacert.org or a related free signing community. Most browsers will throw up warnings, so you shouldn't do it for production (if you are an ebusiness), but during development, or if you don't care about the warnings, it's a cheap alternative
正如其他人所说，您可以简单轻松地使用自签名证书或设置自己的证书颁发机构 (CA)，然后颁发任意数量的证书。 所有这些证书与大型 CA 颁发的“商业”证书一样有效，因此您的证书与威瑞信等机构颁发的证书之间不存在技术差异。
大多数浏览器和其他客户端应用程序对您的证书发出警告的原因是，它们不知道因此不信任您的 CA。 浏览器通常附带数百个众所周知的 CA 证书，每个人都会自动信任（如果这是一件好事，那么......），因此您在通过 HTTPS 访问 amazon.com 时不会收到警告。 在 Firefox 中，您可以转到“首选项”> “高级”> “加密”> “查看证书”可查看您的浏览器当前信任哪些 CA 或单个证书。
最终，这是您和您的服务的用户信任谁的问题。 如果您的用户了解并信任您（例如在公司网络或小型开发团队中），他们可以将您的 CA 证书添加到其浏览器中的受信任证书中。 从那时起，您自己的 CA 颁发的每个证书都不会生成警告，并且将像其他所有证书一样受到信任。
As others have said, you can simply and easily use self-signed certificates or set up your own certificate authority (CA) and then issue as many certificates as you want. All these certificates are as valid as the "commercial" ones issued by the big CAs, so there is no technical difference between your certificate and the one from, say, verisign.
The reason most browsers and other client applications warn about your certificate is, that they do not know and therefore not trust your CA. Browsers usually come with hundreds of well-known CA certificates everyone automatically trusts (if thats a good thing, well...), so you don't get a warning when visiting amazon.com via HTTPS. In Firefox, you can go to "Preferences" > "Advanced" > "Encryption" > "View Certificates" to see which CAs or individual certificates your browser currently trusts.
In the end, it's a question of whom you and the users of your service trust. If your users know and trust you (say in company network or a small development team), they can add your CAs certificate to the trusted certificates in their browser. From then, every certificate issued by your own CA will generate no warning and will be trusted just like every other certificate.