0

In all my Googling, I found one version of FireFox that allowed it temporarily a long time ago, it has been discussed on the Chromium development forums for years, but yet, as of today, there is still no way for an end user to view and/or manipulate SSL information via an extension, add-on, or browser plugin.

Why?

Are SSL Certificates not an essential part of the web browsing experience? What is the justification for excluding them from browser extensions?

Aren't there many users who would like and appreciate the extra information plugins could provide while browsing SSL sites?

With SSL access, plugins could:

  • Compare certificates based on different parts of the world
  • Pin their own untrusted certificates for themselves
  • Build their own trust networks
  • Pin public SSL certs when entering regions of the world where dictatorship regimes that support censorship and spying are likely to forge big name certificates.
  • Collect specific data about different certificate authorities that would be valuable to the web community at large.
  • Get alerts when certain certificates match certain criteria.

Why is it, in 2021, there are no modern web browsers that allow you to view the SSL information of the site you are currently browsing?

Is this a case of browser makers being unwilling to fight against the entrenched system of Trusted Certificate Authorities which simply has more money (or political clout) backing it?

Isn't this a major hold-back technologically?

Since there are two major open source browsers (Chromium and Firefox), why has the community collectively decided not to add this functionality?

Any other reasons you can think of?

Improve this question
8
  • And I'm seeing Chrome extensions that allow you to view TLS certs. Even test them against SSLLabs (which includes CAA info). Can you be more explicit about what you are hoping to see, not why you think you should see what want?
    – schroeder ♦
    Aug 29, 2021 at 22:32
  • By the way, some of the functionality you hope could come from the extensions you envision would require that the extension override the basic function of the connection that the browser makes. That's at the wrong end of the tech stack (i.e. "too late") What you appear to be looking for is a custom browser where the user gets to determine at handshake time whether the connection completes. This is not a reasonable end-user function.
    – schroeder ♦
    Aug 29, 2021 at 22:38
  • 2
    @schroeder I agree, But, at least - if the extension warns the user after they connect to their bank's website that the certificate has changed unexpectedly, then they might check it out before proceeding to enter their login credentials.
    – mti2935
    Aug 29, 2021 at 23:03
  • 2
    Do you mean "you" the user, or an extension you install? Because you mention extensions a lot, but also say "you" instead of "an extension" where I'd expect you to. Which is weird, because it's quite easy to view both the certificate and cipher in Firefox, and indeed I don't know of any browsers clear back to like IE6 that didn't make it pretty easy to view the certificate.
    – CBHacking
    Aug 30, 2021 at 7:08
  • 2
    @8vtwo Nor did I ever claim there wasn't. You're the one who wrote a question full of "allow you to", "an end user to", etc., all the way up to the title. I don't know about you, but personally, I'm not a browser extension! The question, as asked in the title, makes no sense; I the end user am perfectly able to view certs and ciphers, mark them as trusted or untrusted, and so on. I just asked you to clarify your question, and you went responding to claims I hadn't made.
    – CBHacking
    Aug 31, 2021 at 5:32

1 Answer 1

Reset to default
2

I agree, there are several good use cases for browser extensions to access certificate information, including the ones that you mention in your question.

For several years, it wasn't possible for browser extensions to access certificate information, but it seems that now it is possible. There is a long thread about this on Mozilla's Bugzilla at: https://bugzilla.mozilla.org/show_bug.cgi?id=1322748

See the post by Will Bamberg in the above thread (near the end).

It looks like the relevant functions are:

https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/webRequest/getSecurityInfo

https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/webRequest/SecurityInfo

https://developer.mozilla.org/en-US/Add-ons/WebExtensions/API/webRequest/CertificateInfo

Improve this answer
16
  • 1
    Wow that's been in firefox since 62? I thought it was removed, I must have been thinking of Google's attempt. Looks like I found my new daily browser. Thanks.
    – 8vtwo
    Aug 30, 2021 at 0:36
  • 1
    Oh well thats too bad, but HEY its better than nothing! I think there may still be a way to turn the untusted message off? at least I manged it in Chrome with a few startup flags. I don't really see the whole point of "trusted" CAs to begin with since nobody trusts any of these unknown entities. We just care about the encryption usually. But it would be nice to build a peer to peer certificate trust system or something where there is something tangible backing the "trust"
    – 8vtwo
    Aug 30, 2021 at 2:06
  • 1
    @8vtwo You might want to take a look at Moxie Marlinspike's 'Convergence' project. See en.wikipedia.org/wiki/Convergence_(SSL)
    – mti2935
    Aug 30, 2021 at 10:13
  • 1
    While interesting, the wiki was a little light on the details. I can think of many creative ways to form webs of trust especially with some of the new modern technologies. But if you think about it, what does a CA do really? All they ask is you validate by DNS. So DNS validation of SSL certs should be considered the standard norm and requires no trust except in the ongoing validity of DNS.
    – 8vtwo
    Aug 30, 2021 at 16:13
  • 1
    @8vtwo You're right, the wikipedia article is just a summary. See this video by Moxie for much more detail about Convergence: youtube.com/watch?v=Z7Wl2FW2TcA. He also talks about some of the other ideas that you mentioned as well in this video. I agree with you that all of the valldation that a CA does rests on DNS. WRT DNS validation of SSL certs should be considered the standard norm - this sounds like DNSSEC and/or DANE. In that case, we would be shifting our trust from the CA's to the DNS providers and/or registrars. Moxie talks about this in the above video as well.
    – mti2935
    Aug 30, 2021 at 16:24

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .