5 ms·

>The owner of spi.dod.mil has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website. oh

• oneplane 10y ago
  Same here in Chromium. Typical... The actual problem seems to be with the cert chain. The whole site is a joke, but then again, so are most US govt sites. I don't understand why they have to keep using ugly, outdated and badly operating websites over there.
  • kevinoconnor7 10y ago
    I believe only Apple includes the DoD root ca by default.
    • ch_123 10y ago
      Ah, so that's why it loaded on my iPhone without any warning! (Firefox/Chrome caught the incorrect configuration)
  • pc86 10y ago
    Because they work? Especially if you are Joe Public who has been trained for years to just click past any warnings on any website. Because most people feel their tax dollars are better spent on things other than redesigning government websites because they "look old?"
    • smileysteve 10y ago
      > Because most people feel their tax dollars are better spent on things other than redesigning government websites because they "look old?" The beauty of Twitter Bootstrap is that good get a modern responsive website with less work than rolling your own design, or even having to think about it.
• deleted 10y ago
  [deleted]
• blcknight 10y ago
  It's signed by the DoD CA.
  • perlgeek 10y ago
    Maybe they should get their CA cross-signed by one that's in all major browsers.
    • dogma1138 10y ago
      Arguably there would be quite a few people who object to the DoD getting their CA's into browsers this isn't a good precedent. DoD today, UK MOD tomorrow, Russia and China when?
      • MichaelGG 10y ago
        What's the problem? Sounds like a good idea. If they ever abuse their status they get revoked, causing them a lot of pain. More pain than if they hadn't been depending on being trusted in the first place.
        • dogma1138 10y ago
          Revoking CA's is considerably harder than you think it might work for you but it might not work for the tons of people that do not update their browsers or operating systems. Private/Internal/Enterprise CA's are intentionally out of the ring of trust for SSL certificates, there is no need to give the DoD any preferential treatment. This would literally benefit no one as anyone with any interest in accessing those websites would install the certificate. US .gov sites are "secured" with commercial CA certificates so they aren't even part of the argument. When you count the benefit / usefulness of this change which is very little to null and compare it to the possibility of it being abused as well as the precedent of adding "internal" certificate authorities to the global trust list I see a pretty solid argument against this. Overall with things like LetsEncrypt I hope that the CA/SSL Cert industry would get disrupted enough for most if not all commercial CA's to simply become irrelevant. It's not a question of insurance rather than a technical issue since you still get an 'n' figures "fraud" insurance when you purchase validated SSL certificates from commercial CA's and some standards require you to use them rather than LE and the likes. To my knowledge I do not know of any case on which that insurance has ever been successfully claimed so this entire premise should be just killed off completely. 'LE' and similar services should then be managed by a non-profit or a handful of those maybe for each region and just be done with it, the CA list is already too big and it's already near impossible to figure out who owns what besides the <10 big players. I honestly see no reason for SSL to work a browser have to have a list of 130-150 CA's on file (default Root+Intermediate CA listing on Windows).