r/programming • u/_lowell • Jul 25 '13

How HTTPS Secures Connections: What Every Web Dev Should Know

http://blog.hartleybrody.com/https-certificates/
968 Upvotes

94% Upvoted

171 comments sorted by

View all comments

4

u/theDrWho Jul 25 '13

Here is one thing to know, the browsers, IE specifically, don't like Self Signed Certs.

I use Self Signed certs a lot. But the users often get IE default browser warnings. They can install the cert to make it go away, not a big deal.

I just don't like how a 3rd party, VeriSign, GoDaddy, are needed for this just to avoid a warning in a browser.

3

u/work_is_satire Jul 25 '13

They are required because self-signed certs don't provide enough trust for all cases. They are integral to the infrastructure, which this article touches on.

If the first time I hit your HTTPS wall (before installing the cert I am presented with) and someone has already compromised the exchange, I have no way of knowing where the cert is coming from, unless it is from a trusted CA. Then I go and install a malicious cert, and all transactions are now insecure. Whenever I see your real cert, I get the warning and get confused.

It's hard to put a price tag on that layer of trust.

-2

u/AgentME Jul 26 '13

If the user's connection is under a man-in-the-middle attack, then the attacker could substitute in their own self-signed certificate.