Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Consider a setup where all HTTP/HTTPS traffic goes through a proxy. The certificate of this proxy must be trusted by all browsers (in this case, Firefox). This certificate replaces the original certificate for all HTTPS connections to hosts which are not in a whitelist maintained by the sysadmin. As such, all HTTPS traffic to non-whitelisted hosts can be inspected at the proxy.

To check whether a connection has been whitelisted, I can simply right-click and go to View Page Info → Security to see the "Verified by" field. This is a bit of a cludge, and I don't want to have to go through these steps manually for every HTTPS connection. So how can I display the certificate issuer for the current connection at all times in Firefox?

share|improve this question
1  
Let me see if I understand. If Host X is whitelisted and Host Y is not whitelisted: a user's browser with a HTTPS connection to Host X through Proxy P will see a cert for Host X. a user's browser with a HTTPS connection to Host Y will see a cert for Proxy P. And you want the browser to show the name on the cert for any HTTPS connection? I would think that a standard browser configuration would put up a page warning that the cert doesn't match the URL. –  this.josh Jun 30 '11 at 23:25
    
@this.josh: Nope, it does a man-in-the-middle replacement of the certificate, using a trusted certificate. Firefox does not complain. –  l0b0 Jul 4 '11 at 11:18
    
Thanks, now I understand. –  this.josh Jul 4 '11 at 16:08
    
Give the current answers and comments, I think that what you want is not productive. There are already ways, with a bit of user input, to get the data you want. Modifying the browser, or creating a plugin would likely be much more effort than it is worth. –  this.josh Jul 7 '11 at 18:23

3 Answers 3

With Firefox 5.0 (at least - not sure about previous versions...) I'm getting exactly this type of information every time I put the pointer on the left side of the address bar, where the site logo is displayed.

enter image description here

(the pointer is missing in the screenshot but it's over the amazon logo)

Which Firefox version are you using?

share|improve this answer
    
Ditto for Firefox 3.6, but the issue is to avoid any keyboard / mouse interaction for every single HTTPS connection. –  l0b0 Jul 4 '11 at 11:25
    
That is not clear in the question. I though you wanted to avoid right click etc. etc. –  Georgios Jul 4 '11 at 12:32
    
I thought "display ... at all times" was pretty clear. There are probably about a hundred places with hover text on my desktop at any given moment. –  l0b0 Jul 4 '11 at 14:47
up vote 2 down vote accepted

A partial solution is using CipherFox and adding $CERTORG to the cipher format string. Unfortunately it only displays a single certification organization, while the rest are displayed when clicking the text.

share|improve this answer

Have you considered marking that CA as untrusted, and setting up a tunnel or VPN to tunnel all your traffic out to the outside world in a way that it can't be inspected by the proxy? This proxy sounds very unfriendly to security -- it is basically mounting a man-in-the-middle attack on you -- so my first reaction if I wanted to secure my own system would be to try to bypass it so I could get real end-to-end security.

share|improve this answer
    
-1, Neither circumvention nor security is at question here. –  l0b0 Jul 4 '11 at 11:27
2  
@l0b0 well, if security is not at question here, then why is the question here? It is always implied that a secure solution is preferred than a supposed solution posed in a question. –  AviD Jul 5 '11 at 0:18
    
@AviD: It's obviously about security (or rather the lack of it), but not about the most secure way of doing things. Unfortunately this procedure has been mandated from "above." –  l0b0 Jul 7 '11 at 7:00

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.