Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption.

This article says SGC should never be used and it enables malicious (hacker) use, at the same time, there is a contradicting opinion at the bottom of the article.

Also, I noticed that some sites still support SGC encryption, but also have an "A" rating by SSL Labs.

  • Is it actually bad to support SGC?

  • What is special about a SGC certificate, or webserver that makes it "work". I'd like to understand how it works so I can properly shut it down.

share|improve this question
Oh, for a second there I thought you were talking about Stargate Command. – Iszi Jun 29 '12 at 19:26
up vote 2 down vote accepted

The argument basically seems to be that SGC certificated are only useful for a handful of ancient browsers, whose vendor support has long since ended, and those browsers already contain plenty of security holes that make them insecure regardless of what encryption might or might not be used.

Thus, allowing users to establish an HTTPS connection to your site using one of those ancient browsers is only creating an illusion of security. The user might think they're safe because they're using HTTPS, but in fact their browser is almost certainly infested with malware that could be logging everything they do, HTTPS or not.

If you care about your users' security, the only thing you should be sending to those browsers is a security warning and a request to upgrade. If you don't care about security, well, why are you bothering with HTTPS in the first place?

All that said, there doesn't seem to be any intrinsic security flaw in SGC certificates — they work just fine, provided that you're using a modern, secure browser. They're just not really needed by any such browser.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.