Definition
Plain language
An ID a server issues to itself, which nobody outside vouches for.
As stated in the literature
X.509 certificate not signed by a trusted certificate authority; common on internal and staging hosts, and rejected by default by strict TLS clients, which is what makes it a convenient poison in a benchmark.
Also called: self-signed certificates, self-signed
Why it matters: They are harmless and common inside a company, but they create constant pressure to switch off verification — a habit that becomes dangerous the moment the same code faces the open internet.
For example, a test server a team spins up on their own laptop usually presents a certificate it made for itself, which is why browsers show a scary warning when you visit it.
Heard on the show
“Every test server just presents a self-signed certificate.”Episode 268 — A Rigged Benchmark Taught a Self-Improving Agent to Always Disable SSL