The implementation of SSL based on certificates appears to cover two things, network traffic encryption and trust. These two things are entirely different but are inextricably linked in current browser implementations. This is a pain for most of us who want to use SSL on the cheap.

Most people want SSL to provide over the wire encryption for some of their data. The desired use of SSL is mainly restricted to protecting the logon form in a cookie based session management / authentication scheme. For this purpose, a certificate costing $1000 per year is over-kill and places the technology out of the reach of hobbyists and small-scale implementors.

If I am running an e-business site, my users might be interested to know that their credit card details are being sent to a company that has submitted it's legal status to the scrutiny of a CA. For somebody carrying out online monetary transactions, $1000 is probably a good investment.

The irony of the situation is that a web site that uses an SSL certificate based on a trusted CA is unlikely to provoke the user to review the validity of the certificate or site because it takes effort to review the security profile of the site. A site that uses a non-trusted certificate however, is immediately brought to the user's attention due to the prompt that appears.

It could be argued that a site that makes it quite clear that the user is being redirected to a page that will require them to accept a non-trusted certificate is no more harmful to the user experience than the sites that make you agree to pages of legal text before continuing. The user has the option of installing the certificate for future use. While not ideal, this approach gives over the wire encryption and raises awareness in end users.

inman

In reply to Re: (OT) SSL Certificates: Self-Signing and Alternative Solutions by inman
in thread (OT) SSL Certificates: Self-Signing and Alternative Solutions by Anonymous Monk

Title:
Use:  <p> text here (a paragraph) </p>
and:  <code> code here </code>
to format your post, it's "PerlMonks-approved HTML":


  • Posts are HTML formatted. Put <p> </p> tags around your paragraphs. Put <code> </code> tags around your code and data!
  • Titles consisting of a single word are discouraged, and in most cases are disallowed outright.
  • Read Where should I post X? if you're not absolutely sure you're posting in the right place.
  • Please read these before you post! —
  • Posts may use any of the Perl Monks Approved HTML tags:
    a, abbr, b, big, blockquote, br, caption, center, col, colgroup, dd, del, details, div, dl, dt, em, font, h1, h2, h3, h4, h5, h6, hr, i, ins, li, ol, p, pre, readmore, small, span, spoiler, strike, strong, sub, summary, sup, table, tbody, td, tfoot, th, thead, tr, tt, u, ul, wbr
  • You may need to use entities for some characters, as follows. (Exception: Within code tags, you can put the characters literally.)
            For:     Use:
    & &amp;
    < &lt;
    > &gt;
    [ &#91;
    ] &#93;
  • Link using PerlMonks shortcuts! What shortcuts can I use for linking?
  • See Writeup Formatting Tips and other pages linked from there for more info.