Front cover - IBM Redbooks

Figure 6-24 Warning message of an untrusted site
Note: It is not wise, specially for intranet sites, to establish a server that
provides SSL connections, but for which the server certificate is not issued
from a known and trusted certificate. Sure, users can be told to accept access
to a host that appears untrusted, but that’s a serious precedent to set and
could undermine the security of the organization in that users will be more
likely to trust sites they shouldn’t when connecting to the Internet from the
corporate network. It is a best practice to purchase a certificate from one of
the known CAs, such as VeriSign.
Serving certificates to browsers
Since a public key certificate provides proof of identity, it is reasonable to
assume that the level of proof needed for a client is much lower than that needed
for a server.
Before providing a server certificate, the CA will require documentary proof of the
legitimacy of the request. For a client, this proof can often be provided online,
because a lower level of checking is needed. This is especially true of an intranet
environment. Certificate server products are initially intended for organizations
that want to set up an internal authentication process.
Netscape uses a different mechanism than other browsers (such as Mozilla,
Opera, IE, Lynx, and so forth) for initiating a client certificate request.
Chapter 6. Public key infrastructures 259