Firefox 3 changed how it handles self-signed SSL certificates — it gives users a big scary full-page warning that “The certificate is not trusted because it is self signed.” You can add an exception for sites using self-signed certificates, but Firefox will warn you that ““Legitimate sites will not ask you to do this.”
The change has made some people unhappy, including Nat Tuck Thu who writes,
Now, it’s an interesting question as to exactly what the user interface should show for a self-signed website. Obviously it shouldn’t show a green address bar like the new (extra high price, major corporation only) EV certificates. But there is absolutely no excuse for it to be significanly less inviting to a normal user than an unencrypted site.
This is really an issue of the basic principles of internet openness. Everyone has equal access to the features of HTTP or SSH, there’s no reason why there should be artifical constraints on access to HTTPS. But that’s exactly what the Firefox SSL behavior does.
In response to various critics of the Firefox approach, Johnathan Nightingale makes a persuasive case in favor of Firefox’s handling of self-signed certificates,
The question isn’t whether you trust your buddy’s webmail – of course you do, your buddy’s a good guy – the question is whether that’s even his server at all. With a CA-signed cert, we trust that it is – CAs are required to maintain third party audits of their issuing criteria, and Mozilla requires verification of domain ownership to be one of them.
With a self-signed certificate, we don’t know whether to trust it or not. It’s not that these certificates are implicitly evil, it’s that they are implicitly untrusted – no one has vouched for them, so we ask the user. There is language in the dialogs that talks about how legitimate banks and other public web sites shouldn’t use them, because it is in precisely those cases that we want novice users to feel some trepidation, and exercise some caution. There is a real possibility there, hopefully slim, that they are being attacked, and there is no other way for us to know.
On the other hand – if you visit a server which does have a legitimate need for a self-signed certificate, Firefox basically asks you to say “I know you don’t trust this certificate, but I do.” You add an exception, and assuming you make it permanent, Firefox will begin trusting that specific cert to identify that specific site. What’s more, you’ll now get the same protection as a CA signed cert – if you are attacked and someone tries to insert themselves between you and your webmail, the warning will come up again.
One of the complaints I’ve seen in a number of forums is that with a CA signed cert you’re paying potentially hundreds of dollars, but it turns out there are free cert provides. StartSSL, for example, has a free cert, for example. They verify domain ownership by requiring you to upload an arbitrary file to the website you want the cert for.
This has become one of my more annoyances when I have to admin my servers from the web!
Also, i was contemplating how upset a retailer would be if they blundered and ever had problems with their own certificates, you could potentially loose a good precentage of revenue.
I think Firefox is confusing IDENTITY with Encryption. Go ahead and say it is not identified. But a self-signed encrypted site is SAFER than an unencrypted site, since the data is encrypted. Firefox should treat self-signed certificate sites as encrypted but not identified, because that is what it is. So basically, Firefox is saying that an unencrypted unidentified sites is SAFER than a encrypted unidentified site? That makes no sense. Unless Firefox is getting paid by the commercial certificate makes to discourage people from encrypting their own data themselves for free.
I am very surprised that Firefox can’t tell the difference between identity and encryption. They seem to be assuming the only reason you get a certificate is to identify yourself. Actually, most websites are getting it to encrypt their data.