90

Right now I installed ubuntu 12.04.3 server which I want to access via ssh. For that reason I created a private key which I moved to

/etc/ssl/private/

I'm just wondering why there already is private key ssl-cert-snakeoil.key in there. Where is this private key used and can I delete it?

1
  • 10
    Self-signed certificates are termed as snake-oil certificates because these are not signed by public CA.
    – user267155
    Apr 9, 2014 at 17:09

2 Answers 2

71

The ssl-snakeoil.key is a key created by ssl-cert package post-install scripts. It's created for the snakeoil user and should not be deleted:

grep '#' /var/lib/dpkg/info/ssl-cert.postinst 
#!/bin/sh -e
# Create the ssl-cert system group for snakeoil ownership:
# Check if the generated snakeoil key/cert has been generated 
# from a vulnerable openssl version and replace it if necessary.
    # check if the cert and key file exist,
    # the issuer and subject are the same (self signed cert)
    # and the private key is vulnerable
# no need to perform any check. If the certificates are there
# it will exit 0.
# allow group ssl-cert to access /etc/ssl/private
# If we're upgrading from an older version, fix the unreadable key:

Now, what's the ssl-cert package:

This package enables unattended installs of packages that need to create SSL certificates.

It is a simple wrapper for OpenSSL's certificate request utility that feeds it with the correct user variables.

So it is a certificate used to install packages that need to create SSL certificates, so the system generates one on the fly with the installation of this package.

As a side note, this package is not exclusive to Ubuntu, since it also appears in Debian.

8
  • 9
    Wow! insightful. Can you tell what this snakeoil user is? Mar 1, 2014 at 16:27
  • 1
    @humanityANDpeace oil made of snakes...?
    – Braiam
    Mar 1, 2014 at 16:29
  • 1
    @humanityANDpeace there's no snakeoil user.
    – Braiam
    Mar 1, 2014 at 16:35
  • 5
    :) I am aware of the work origin and general meaning of snakeoil. In the answer above you say it's created for the snakeoil user and should not be deleted: which is why I thought there was one. Mar 1, 2014 at 17:51
  • 35
    If people don't know the idiom, "snake oil" basically means fake and should not be trusted. Sep 30, 2014 at 17:37
40

It's a server-specific public and private key pair created when the server's Debian based OS is installed (like Ubuntu).

It is used in cases where no other SSL certificate is installed or configured, but encrypted communication is enabled and desired.

While it does securely encrypt traffic, it is insecure and thus named 'snakeoil' because it's lack of root authority signature means it is vulnerable to the most simple man-in-the-middle attacks.

Website administrators really need to reconfigure services that reference the snakeoil key with a properly signed key from their CA, like the one they hopefully use for HTTPS.

4
  • 5
    Would you have an example / link in regard to the type of man-in-the-middle type of attack such a certificate is prone to? Oct 29, 2016 at 3:00
  • 9
    Since the certificate can't be validated, then ANY OTHER certificate could be accepted by the client UNLESS they have pre-authorized this particular certificate OR are particularly diligent in checking it's fingerprint. In short, the CAs exist for a good reason (other than profit ;p).
    – dyasta
    Oct 31, 2016 at 11:22
  • But for local development - does it matter if I use a freshly created self-signed certificate or the existing snakeoil one? Jul 13, 2021 at 23:31
  • For a local development the snakeoil as any other self signed certs MAY be fine but it has two problems: 1. It will expire in a year. 2. It may be too week and apps won't accept it and even fail to start eleni.blog/2019/04/10/the-snakeoil-ssl-certificate Ideally the ssl-cert package must automatically regenerate the cert by cron and also register an own CA trusted by the local machine only. But why would you use https for local requests? Jun 7 at 23:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.