62

Right now I installed ubuntu 12.04.3 server which I want to access via ssh. For that reason I created a private key which I moved to

/etc/ssl/private/

I'm just wondering why there already is private key ssl-cert-snakeoil.key in there. Where is this private key used and can I delete it?

  • 8
    Self-signed certificates are termed as snake-oil certificates because these are not signed by public CA. – user267155 Apr 9 '14 at 17:09
46

The ssl-snakeoil.key is a key created by ssl-cert package post-install scripts. It's created for the snakeoil user and should not be deleted:

grep '#' /var/lib/dpkg/info/ssl-cert.postinst 
#!/bin/sh -e
# Create the ssl-cert system group for snakeoil ownership:
# Check if the generated snakeoil key/cert has been generated 
# from a vulnerable openssl version and replace it if necessary.
    # check if the cert and key file exist,
    # the issuer and subject are the same (self signed cert)
    # and the private key is vulnerable
# no need to perform any check. If the certificates are there
# it will exit 0.
# allow group ssl-cert to access /etc/ssl/private
# If we're upgrading from an older version, fix the unreadable key:

Now, what's the ssl-cert package:

This package enables unattended installs of packages that need to create SSL certificates.

It is a simple wrapper for OpenSSL's certificate request utility that feeds it with the correct user variables.

So it is a certificate used to install packages that need to create SSL certificates, so the system generates one on the fly with the installation of this package.

As a side note, this package is not exclusive to Ubuntu, since it also appears in Debian.

  • 7
    Wow! insightful. Can you tell what this snakeoil user is? – humanityANDpeace Mar 1 '14 at 16:27
  • 1
    @humanityANDpeace oil made of snakes...? – Braiam Mar 1 '14 at 16:29
  • @humanityANDpeace there's no snakeoil user. – Braiam Mar 1 '14 at 16:35
  • 4
    :) I am aware of the work origin and general meaning of snakeoil. In the answer above you say it's created for the snakeoil user and should not be deleted: which is why I thought there was one. – humanityANDpeace Mar 1 '14 at 17:51
  • 20
    If people don't know the idiom, "snake oil" basically means fake and should not be trusted. – Collin Anderson Sep 30 '14 at 17:37
24

It's a server-specific public and private key pair created when the server's Debian based OS is installed (like Ubuntu).

It is used in cases where no other SSL certificate is installed or configured, but encrypted communication is enabled and desired.

While it does securely encrypt traffic, it is insecure and thus named 'snakeoil' because it's lack of root authority signature means it is vulnerable to the most simple man-in-the-middle attacks.

Website administrators really need to reconfigure services that reference the snakeoil key with a properly signed key from their CA, like the one they hopefully use for HTTPS.

  • 4
    Would you have an example / link in regard to the type of man-in-the-middle type of attack such a certificate is prone to? – Alexis Wilke Oct 29 '16 at 3:00
  • 5
    Since the certificate can't be validated, then ANY OTHER certificate could be accepted by the client UNLESS they have pre-authorized this particular certificate OR are particularly diligent in checking it's fingerprint. In short, the CAs exist for a good reason (other than profit ;p). – dyasta Oct 31 '16 at 11:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.