0

If a webserver has an HTTPS certificate and a page on the server pulls resources from other webservers - maybe a CDN with a protocoless path, or not, for things like static images, stylesheets, and JS libraries - which web servers' HTTPS certificate are they verified by? It seems like that might be important given things like SSL-strip.

Improve this question

1 Answer 1

Reset to default
3

If it gets resources from a site like a CDN the certificate will be verified against the URL of this resource, in this case the CDN. The URL of the HTML file embedding these resources does not matter in this case, only the URL of the resource itself.

... with a protocoless path

A path like //host/page instead of http://host/page or https://host/page just means that the same protocol should be used as the embedding page uses. But this does affect how the certificate will be validated.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .