Browsers And Unsigned Certificates

Browsers And Unsigned Certificates

by Larry Seltzer

Read Larry Seltzer’s article on The Untrustworthiness of Self-Signed Certificates.

Browsers And Unsigned Certificates – Suspicious of SSL

Making the Web “safe by default,” browsers are suspicious of SSL Web sites (those with a https:// prefix) that use certificates not signed by a trusted authority – VeriSign, GlobalSign, GoDaddy or Thawte. Firefox 3 in particular makes you jump through hoops just to view such a page. The hoopla has some are asking if SSL certifications are even necessary.

Browsers And Unsigned Certificates – Firefox 3: Dire Warning

Browse an https Web page with Firefox 3 and you get a dire warning in the browser window and a dialog box with essentially the same warning. First, you have to get the dialog box out of the way.

Browsers And Unsigned Certificates – Firefox 3: Add an Exception

If you want to ignore the warnings you can click the Add an Exception link in the page and press the redundant Add Exception button. An exception is a browser rule that allows a page to get around the rule against self-signed certificates.

Browsers And Unsigned Certificates – Firefox 3: Are You Sure You Want to Do That?

At this point Firefox makes you click yet another button in order to add an exception, but not until you get to read another dire warning about what a bad idea it is to do this.

Browsers And Unsigned Certificates – Firefox 3: Confirm Your Exception

Almost done. Now that you’ve created the rule you have to confirm it. Note that Firefox takes the time to bad-mouth the page for you again and remind you that it’s not trustworthy. Press the Confirm Security Exception button.

Browsers And Unsigned Certificates – Firefox 3: Through the Checkpoint

Finally, you’re past the Firefox security guards and can view your dangerous Web site. At this point, the warnings are over, and everything looks normal.

Browsers And Unsigned Certificates – Internet Explorer 7: Verbose Warning

Internet Explorer 7 has one verbose warning page for SSL pages with self-signed certificates. It tells you there may be a problem, that this may be an attempt to trick you, and then asks you how you want to proceed.

Browsers And Unsigned Certificates – Internet Explorer 7: Red Signal

Choose to continue on to the Web page and there you are, although IE makes the address bar red and shows a certificate error.

Browsers And Unsigned Certificates – Opera 9.5: Warning Message

Opera 9.51 also issues a conspicuous warning and, like IE, immediately allows you to proceed or abort.

Browsers And Unsigned Certificates – Opera 9.5: A Little Technical Detail

Opera makes the circumstances clear with a little technical detail and a terse description of the problem in the security tab of the warning dialog box.

Browsers And Unsigned Certificates – Opera 9.5: On to the Web Page

Move on to the Web page and Opera, like Firefox, shows the page with no warnings or errors.

Browsers And Unsigned Certificates – See More Slideshows Like This One

10 Things You Should Know About Databases10 New Technologies IBM Is Cooking in Its Innovation Labsby Clint BoultonA Uniform Desktop Is a Secure Desktopby Cameron SturdevantThe 15 Most Influential People in Security Todayby Ryan Naraine