4 ms·
Right. It is questionable why self-signed certificates trigger scary warnings in browsers when totally unencrypted connections do not. I think the whole UI asp
by MattJ100 12y ago
Right. It is questionable why self-signed certificates trigger scary warnings in browsers when totally unencrypted connections do not.
I think the whole UI aspect of web transport security needs re-thinking.
- MichaelGG 12y agoIt's pretty simple: An unvalidated/unauthenticated certificate looks like a MITM. Requesting an HTTPS resource indicates you want a secured connection. If the certificate is not trusted, then you don't have a secure connection. The criteria is not self-signed, it's trusted/authenticated or not. Most self-signed certs are not trusted, and solving that solves the CA problem. But if a self-signed cert is trusted then browsers happily display the secure UI without any errors.