When is it possible to use a self-signed certificate, rather than one purchased from a commercial certificate authority?

A self-signed certificate, or more accurately, a certificate signed by a private Certificate Authority (CA), is appropriate for an internal enterprise environment where all client devices are managed. In such a scenario, the root certificate of the private CA can be distributed and installed as a trusted root authority on all company computers, often automatically via tools like Active Directory Group Policy. Once the clients trust the internal CA, any certificate it issues for internal servers (like those protected by FortiWeb) will be validated without security warnings, creating a secure and trusted internal Public Key Infrastructure (PKI).

A. The device type (mobile vs. desktop) is irrelevant; trust must be established on all clients, which is difficult in a mobile-only environment without a Mobile Device Management (MDM) solution that can push the trusted root certificate.

B. Business size is not the primary factor. A small business with a public-facing website would still need a commercial CA certificate to be trusted by external customers' browsers.

D. If resources do not require security or HTTPS, then no certificate of any kind is needed, which makes the choice between certificate types irrelevant.

1. FortiWeb Administration Guide 7.0.0 | Fortinet Docs: In the section "System > Certificates > Local

" the guide explains the process of uploading local CA certificates. This functionality is designed for scenarios where FortiWeb must trust or use certificates from an internal

private CA

which is the core concept described in the correct answer. The premise is that clients have already been configured to trust this private CA. (Reference: FortiWeb Administration Guide 7.0.0

"Certificates

" p. 438).

2. Microsoft Learn - Active Directory Certificate Services (AD CS) Overview: "AD CS provides customizable services for issuing and managing public key certificates used in software security systems that employ public key technologies... You can use AD CS to enhance security by binding the identity of a person

device

or service to a corresponding private key." This official documentation outlines the primary use case for a private CA within an enterprise

which is exactly the scenario in option C. (Reference: Microsoft Learn

"Active Directory Certificate Services Overview

" Document ID: 5f89555d-099c-4242-9b5a-c08748ac74c4).

3. NIST Special Publication 800-32 - Introduction to Public Key Technology and the Federal PKI Infrastructure: Section 2.2

"Public Key Certificate

" and Section 3

"PKI Components

" describe the role of a CA and the concept of a trust anchor. The document implicitly supports the model of a private

enterprise-specific PKI where the organization's CA serves as the trust anchor for all its managed entities. (Reference: NIST SP 800-32

Sections 2.2 and 3).