Behaviour of Firefox for untrusted certificates

[Alexander Sack]

On Tue, Apr 29, 2008 at 07:28:25PM +0200, Martin Graesslin wrote:
> Hi,
> 
> this is my first mail to this list and I hope it is the correct one. I was 
> redirected to use mailinglist for my suggestion made in bug 224307. Here is my 
> initial comment:
> 
> Firefox has a very strange behaviour if you visit a https site which uses 
> self-signed or untrusted certificates.
> Here the error:
>  "Secure Connection Failed
>  mail.martin-graesslin.com uses an invalid security certificate.
>  The certificate is not trusted because the issuer certificate is not trusted.
>  The certificate is not valid for any server names.
>  (Error code: sec_error_untrusted_issuer)
>      * This could be a problem with the server's configuration, or it could be 
> someone trying to impersonate the server.
>      * If you have connected to this server successfully in the past, the 
> error may be temporary, and you can try again later."
> 

That page also offers the option to add an exception. This was
done in order to prevent users from just clicking-through.

> IMHO this behaviour is wrong. Firefox should load the page nevertheless. 
> Authentification is not the most important feature of TLS, but
> encryption.

There are multiple features that make up TLS. If you make one of these
features void, the whole building tumbles. In this particular case,
making it easy to ignore untrusted issuer errors will train the user
to not care about broken certificates at all, finally helping the bad
guys to trick users into submitting confidential data to them and so
on.


 - Alexander