1

Visiting ifttt.com shows a green padlock in my Firefox browser (version 45.7.0 ESR).

When I view the certificate, it is issued to a Common Name (CN) of ssl001.insnw.net which does not match ifttt.com

Why does the browser not display a warning that the issued certificate does not match the domain name?

4

ifttt.com is in the Subject Alternative Names extension in the certificate.

Each certificate has a primary name, but it can also have multiple alternative names. Hosting providers and content distribution networks that host multiple websites but wish to provide SSL Certificates (which is good) often use this method to create certificates that are valid for multiple sites that are hosted by the same service.

This is typically considered safe because the people who own the sites that share a certificate don't actually control the certificate - their hosting provider does. The individual site owners don't have the private key. This means they can't use the fact that they are Subject Alternative Names on a cert to man in the middle sites they share with. The host could, of course, but the host already truly controls those sites - they don't need to man in the middle. You ultimately need to trust them.

  • Troy Hunt (as usual) has some commentary on this : troyhunt.com/… – crovers Jan 26 '17 at 15:06
  • Thanks for the in-depth explanation! I hadn't noticed the "Certificate Subject Alt Name" section of the certificate, but you're right - ifttt.com is in there. – Toby Jan 26 '17 at 15:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.