5 ms·

It appears to me the issue is browser warning dialogs that imply it is always very dangerous. There should be either more context explained in those dialogs or

It appears to me the issue is browser warning dialogs that imply it is always very dangerous. There should be either more context explained in those dialogs or a recognition of/mode for sites that are supposed to be self signed.

dboreham 5y ago
There is a long history to this. The original browser warnings were along the lines of your suggestion. Then it was discovered that regular users just clicked through the warning when an attacker MITM'ed their bank. There followed decades of making the warning ever more scary sounding and ever more difficult to bypass.
- savolai 5y ago
  Where does responsibility lie here? Is there a mechanism for users to state trust towards their org's sysadmin instead of a global authority? If there isn't, what is the problem preventing this in the long history you mention?
ThermalCube 5y ago
(Untested idea) I'd suggest creating your own Root CA with an expire-date far in the future. Install it's public key as a trusted certificate and all derived certificates should not prompt any issues anymore
- spyke112 5y ago
  Please don't. I've been in orgs doing this and it sucks. There seems to just be to many edge cases, and to many custom scripts for setup.
- coding_unit_1 5y ago
  That's not untested insofar as that's how I've always seen self-signed certs managed in an org.
- PinguTS 5y ago
  Then far in the future, when your own Root CA expires, then there comes all the trouble to update all the services/devices to trust the new Root CA. This becomes a nightmare, when the original admin in the org is gone long times ago.
- tqwhite 5y ago
  I did this on my workstation. I used it for a short while. Then I realized that I was actually putting a thing into the world that circumvents the entire security infrastructure of the world. Then I needed to do it for a server. Local only. Never production. Then I thought, WTF am I doing?. I realized that I was making computers that would circumvent the world's security apparatus. Of course it won't hurt if I make no errors of practice or judgement but, am I really smart enough to handle highly radioactive material. I ripped it all out. It makes me shudder thinking about it.

dboreham 5y ago

There is a long history to this. The original browser warnings were along the lines of your suggestion. Then it was discovered that regular users just clicked through the warning when an attacker MITM'ed their bank. There followed decades of making the warning ever more scary sounding and ever more difficult to bypass.

savolai 5y ago
Where does responsibility lie here? Is there a mechanism for users to state trust towards their org's sysadmin instead of a global authority? If there isn't, what is the problem preventing this in the long history you mention?

ThermalCube 5y ago

(Untested idea) I'd suggest creating your own Root CA with an expire-date far in the future. Install it's public key as a trusted certificate and all derived certificates should not prompt any issues anymore

spyke112 5y ago
Please don't. I've been in orgs doing this and it sucks. There seems to just be to many edge cases, and to many custom scripts for setup.
coding_unit_1 5y ago
That's not untested insofar as that's how I've always seen self-signed certs managed in an org.
PinguTS 5y ago
Then far in the future, when your own Root CA expires, then there comes all the trouble to update all the services/devices to trust the new Root CA. This becomes a nightmare, when the original admin in the org is gone long times ago.
tqwhite 5y ago
I did this on my workstation. I used it for a short while. Then I realized that I was actually putting a thing into the world that circumvents the entire security infrastructure of the world. Then I needed to do it for a server. Local only. Never production. Then I thought, WTF am I doing?. I realized that I was making computers that would circumvent the world's security apparatus. Of course it won't hurt if I make no errors of practice or judgement but, am I really smart enough to handle highly radioactive material. I ripped it all out. It makes me shudder thinking about it.