Firefox’s Invalid Security Certificate

Chris in the office came across an interesting change that’s been made in Firefox 3 that I have to say although it’s probably going to be a nightmare for many users it’s a great thing and will only lead to a “better internet”.

Now if you go to a page online that has “suspicious” SSL certificates you are no longer exposed to a simple and easy to bypass popup window, you now get a full page warning that hopefully shows the user they are doing something above and beyond to bypass.

I found one of the devs on Mozilla had an awesome blog post about the original bug. Included in it was this priceless screen shot showing the old popup and what most people probably read, it’s so true.

I like the new warning. It’s getting more inline with how IE7 handles the same situation.

Hopefully it will make people who use bad SSL setups update their processes so they don’t get affected by this, that is only a good thing for end users.

About this entry

You’re currently reading “Firefox’s Invalid Security Certificate,” an entry on Jon Sykes

Published:: 07.07.08 / 4pm

Category:: Uncategorized

QR Code for this Blog Post

Firefox’s Invalid Security Certificate 07.07.08 / 5pm

[...] View original post here: Firefox’s Invalid Security Certificate [...]

Jesse Thouin 07.15.08 / 10am

Just as we should be able to determine the extent to which our government is allowed to protect us, we should also be able to determine how much our browser protects us.

I work in a development environment with dozens of development servers - none of which have the correct security certificate installed (to save on cost; they’re just dev machines). So now, every time I connect to a dev server in a different way, I have to click through 3 screens to continue my work.

I’m just saying I wish there were a way to disable this feature.

gman16k 08.21.08 / 11am

Yea…same here. These warnings that just require more clicking which is a pain my development environment. I’m looking to disable too. -1 for this feature.

JP 08.21.08 / 12pm

I do agree, there should be a setting in about:config or somewhere that allows you to either blanket turn off these or reduce the leave of freak out, but it would need to be positioned as a development use only feature.

I still maintain that for the end user the change is a good thing.