Does SGC Support reduce HTTPS security?

Question

Server Gated Cryptography is a legacy technology (implemented by obsolete laws) that allows older browsers to establish a SSL session at a higher encryption.

This article says SGC should never be used and it enables malicious (hacker) use, at the same time, there is a contradicting opinion at the bottom of the article.

Also, I noticed that some sites still support SGC encryption, but also have an "A" rating by SSL Labs.

• Is it actually bad to support SGC?

• What is special about a SGC certificate, or webserver that makes it "work". I'd like to understand how it works so I can properly shut it down.

Answer 1

The argument basically seems to be that SGC certificated are only useful for a handful of ancient browsers, whose vendor support has long since ended, and those browsers already contain plenty of security holes that make them insecure regardless of what encryption might or might not be used.

Thus, allowing users to establish an HTTPS connection to your site using one of those ancient browsers is only creating an illusion of security. The user might think they're safe because they're using HTTPS, but in fact their browser is almost certainly infested with malware that could be logging everything they do, HTTPS or not.

If you care about your users' security, the only thing you should be sending to those browsers is a security warning and a request to upgrade. If you don't care about security, well, why are you bothering with HTTPS in the first place?

All that said, there doesn't seem to be any intrinsic security flaw in SGC certificates — they work just fine, provided that you're using a modern, secure browser. They're just not really needed by any such browser.