4 ms·

You can't even see the actual SSL cert in chrome anymore. Some UI decisions just don't make any sense, to the point where I think UI engineers are just trolling

You can't even see the actual SSL cert in chrome anymore. Some UI decisions just don't make any sense, to the point where I think UI engineers are just trolling us all.

deathanatos 9y ago
I can? Open Dev Tools (Click the menu "…" button, More Tools, Developer Tools) then click "Security" then "View Certificate". What annoys me most is that Firefox refuses to show you the certificate if it fails to validate, which makes figuring out validation errors more painful.
- bennofs 9y ago
  > What annoys me most is that Firefox refuses to show you the certificate if it fails to validate, which makes figuring out validation errors more painful. You can view it in Firefox as well: Advanced -> Add exception -> View Or, as I just noticed, when you click on the error code (SEC_ERROR_EXPIRED_CERTIFICATE for example) it'll show you the raw certificate.
  - deathanatos 9y ago
    Ah, thank you! I would not have thought to look under "Add exception", since that's not what I want to do. (I still wish it could also just be in the normal spot.)
- dingo_bat 9y ago
  Ooh! So that's where they stashed it. But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? Earlier, you could click on the https part of the address bar and it would show you the certificate details.
  - deathanatos 9y ago
    No, I don't really expect an average Joe to check certificate details. Explaining certificates to developers is hard enough — I can't imagine trying to get an average joe to comprehend it. What details would they realistically look at, anyways? If the certificate validates, that's an automated check of most of the interesting bits. But the first thing in my dialog, for example, is the subject, which is garbage for many DV certs. Then there's the difference between CN and subjectAltName…
  - vtlynch 9y ago
    >But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? The browser does this for you. Chrome (and all major browsers) have a certificate validation that parses the hostname in the certificate and compares it to the site you are on. Checking certificate details manually is primarily useful for troubleshooting. It serves little to no security benefit for 99% of users.
jloughry 9y ago
You can get to it via Developer Tools.
vtlynch 9y ago
In Chrome 60+, you can enable the old-school certificate viewer with a flag. At some point this will become the default. Flag is: chrome://flags/#show-cert-link Full instructions for those less familiar: https://www.thesslstore.com/blog/enable-certificate-details-chrome-60/ https://www.thesslstore.com/blog/enable-certificate-details-... [self promotion]

You can't even see the actual SSL cert in chrome anymore. Some UI decisions just don't make any sense, to the point where I think UI engineers are just trolling us all.

deathanatos 9y ago

I can? Open Dev Tools (Click the menu "…" button, More Tools, Developer Tools) then click "Security" then "View Certificate". What annoys me most is that Firefox refuses to show you the certificate if it fails to validate, which makes figuring out validation errors more painful.

bennofs 9y ago
> What annoys me most is that Firefox refuses to show you the certificate if it fails to validate, which makes figuring out validation errors more painful. You can view it in Firefox as well: Advanced -> Add exception -> View Or, as I just noticed, when you click on the error code (SEC_ERROR_EXPIRED_CERTIFICATE for example) it'll show you the raw certificate.
- deathanatos 9y ago
  Ah, thank you! I would not have thought to look under "Add exception", since that's not what I want to do. (I still wish it could also just be in the normal spot.)
dingo_bat 9y ago
Ooh! So that's where they stashed it. But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? Earlier, you could click on the https part of the address bar and it would show you the certificate details.
- deathanatos 9y ago
  No, I don't really expect an average Joe to check certificate details. Explaining certificates to developers is hard enough — I can't imagine trying to get an average joe to comprehend it. What details would they realistically look at, anyways? If the certificate validates, that's an automated check of most of the interesting bits. But the first thing in my dialog, for example, is the subject, which is garbage for many DV certs. Then there's the difference between CN and subjectAltName…
- vtlynch 9y ago
  >But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? But aren't regular non-devs supposed to verify certificate name and the name of the website they are on? The browser does this for you. Chrome (and all major browsers) have a certificate validation that parses the hostname in the certificate and compares it to the site you are on. Checking certificate details manually is primarily useful for troubleshooting. It serves little to no security benefit for 99% of users.

jloughry 9y ago

You can get to it via Developer Tools.

vtlynch 9y ago

In Chrome 60+, you can enable the old-school certificate viewer with a flag. At some point this will become the default. Flag is: chrome://flags/#show-cert-link Full instructions for those less familiar: https://www.thesslstore.com/blog/enable-certificate-details-chrome-60/ https://www.thesslstore.com/blog/enable-certificate-details-... [self promotion]