Disable https warnings

anything I don't mind · 16 Sep 2011 at 12:10

Does anyone know how to disable browser warnings for self signed ssl certificates? I can find some information about it for IE. But none for opera or firefox.

There must be a way to prevent the browser from asking for confirmation when accepting self signed certificates. Anyone know?

flip · 16 Sep 2011 at 14:15

for firefox, go to the self signed site, view the certificate and install it, that should stop any subsequent warnings

anything I don't mind · 16 Sep 2011 at 14:17

That is correct, although accepting certs in opera still keeps prompting.

What i am after is a way to prevent the browser from prompting on self signed certs completely.

Ev0 · 16 Sep 2011 at 18:53

Accepting the cert and installing it are different things though.

You need to add the cert to the browsers certificate list so it knows to trust it.

Not used Opera so don't know the process there I'm afraid.

anything I don't mind · 16 Sep 2011 at 18:57

Yea, what i want is for the browser to install and accept self signed certificates as if they were signed certificates.

Like when you go to paypal for example the cert is automatically installed. I want that to happen with self signed certs.

ubern00b · 16 Sep 2011 at 20:26

When you go to paypal a cert isn't automatically installed. Your computer comes with pre-installed root certs for the issuing authorities to which the paypal cert is compared against for validation.

Automatically accepting/installing all self signed certs is incredibly stupid.

Ev0 · 16 Sep 2011 at 20:28

It's not that the cert is automatically installed when you browse paypal, it's that the issuing CA of that certificate is already trusted in your browser.

Ev0 · 16 Sep 2011 at 20:28

lol great minds and all that

anything I don't mind · 16 Sep 2011 at 20:42

ubern00b said:
When you go to paypal a cert isn't automatically installed. Your computer comes with pre-installed root certs for the issuing authorities to which the paypal cert is compared against for validation.

Automatically accepting/installing all self signed certs is incredibly stupid.

Why is it stupid?

Please explain to me why I should not trust ssl certificates that are not signed by certificate authorities but are from websites that i trust?

From what i understand, the worse that can happen is that i accepted a certificate that is not signed and has been compromised and allows a MITM attack possibility to decrypt packets.

What are the other risks ?

It seems non nonsensical to prompt me "are you sure you want to accept", I always click accept anyway, seems like a total waste of time to have to click accept every time.

tntcoder · 16 Sep 2011 at 23:28

Why even bother using SSL then in that case? That's what it's designed for.

Either add trusted self signed certs to your browsers store on an individual basis or use plain HTTP.

Danthus · 16 Sep 2011 at 23:32

groen said:
Why is it stupid?

Please explain to me why I should not trust ssl certificates that are not signed by certificate authorities but are from websites that i trust?

From what i understand, the worse that can happen is that i accepted a certificate that is not signed and has been compromised and allows a MITM attack possibility to decrypt packets.

What are the other risks ?

It seems non nonsensical to prompt me "are you sure you want to accept", I always click accept anyway, seems like a total waste of time to have to click accept every time.

Have you not seen the news recently!

Moredhel · 17 Sep 2011 at 14:21

Hypothetical for you, Green.

You're browsing around one day when you decide to log in to your online banking and Paypal accounts, unbeknownst to you, there's been an XSS vulnerability found on both of them, and your sign in details are actually going to a server in russia.

Of course, because you don't blindly accept SSL certificates, the self signed cert on the russian site, which has the right domain name (because you can give a self signed certificate can have whatever domain you want) still fires up a warning about the certificate being untrusted.

Wondering why the bank website or paypal website is suddenly saying it's using an untrusted certificate, you don't enter your details.

Of course, you could auto accept them, never see a warning and give the russian mob your bank and paypal details.

XSS (cross-site scripting) vulnerabilities are one of the bigger risks out there, also one of the more common.