Security on hashing passwords with CryptoJS and then use php password_hash()

Question

So I got my own little project that I work on and I have a login for my friends to login and post news and update another thing. This site will never hold any personal information, it's just for my own education.

So my question is: Do I need to create a self signed certificate and add that to my Web Host, or pay money for that or can I just use CryptoJS to create a hash and then when it's on server side use php's password_hash() before saving it in the database?

Answer 1

You are talking about two different things. First is SSL and encryption of network second is password hashing in db. To be secure you should use both SSL and password hashing. If you do not want to pay for signed certificate you can create own cert not signed by CA and give it to your friends (in secure manner) they should include it in browser or they should check certificate fingerprint each time they connect to site. Any one who do not have this cert or its fingerprint will not know it there is MITM and browser will complain about it.