New^W NOT in Kestrel #5: As many certificate warnings (if you don’t want them)

As I explained in "NOT in Kestrel #4", the certificate is the passport of the website. What was not significatly mentioned in that article is that if there is any non-fatal problem with the verification of the certificate, or with other related information, Opera (and other clients) will display
a certificate warning.

Problems that cause certificate warnings to be displayed can for example be:

  • The certificate issuer is unknown (and it is not possible to discover a link to a known Root).
  • The certificate is expired
  • The name of the server does not match any of the servers named in the
    certificate.
  • Weak encryption keys (now only public keys)

These warnings are displayed the first time in a session that you connect to a given server, and would not be displayed again for the rest of the session if the user accepted the certificate.

This has (understandably) caused some irritation when a user is frequently visiting a site causing such warnings to be displayed, and there has been frequent requests to be able to accept such certificates more permanently.

I have been, and still am, skeptical to such an ability, because I think a serious and secure website should not trigger security warnings.

I have, however, decided to meet the requests halfway. In Opera 9.50 it is now possible from the security panel of the certificate warning to "permanently" accept a certificate for the given SSL/TLS server (and port). Although accepted by the user, Opera will (same as before) not display a padlock for these sites because Opera has not been able to properly establish the server's credentials.

The acceptance isn't, however, quite "permanent" (therefore the quotes). A certificate that has not expired will be accepted until it expires (at which time the webmaster SHOULD replace it), and for periods of 90 days at a time after expiration.

Enjoy, but use with caution.

Seasons Greetings! See you in the new year.

2 thoughts on “New^W NOT in Kestrel #5: As many certificate warnings (if you don’t want them)”

  1. I have checked option to not notify about warning on some site. I had to also accept certificate permanently cause issuer was not known to Opera.Now Opera does not ask to accept certificate as expected, but in Security panel it says:The connection to xxx is not secure, and should not be used to exchange sensitive information.The following problem(s) were found: You have asked to be warned about certificates from this issuerShouldn’t the last sentance say “You have asked NOT to be warned…”. Or this is something different?As checkbox is not re-selected by Opera, I assume this message should give me information about current “ignore warning” status.

Comments are closed.