0

I have a application, that can communicate with some other devices on local network and it has a possibility to turn on only HTTPS communication in its GUI. However since the application is specially made for communicating with certain device and the device has only self signed SSL certificate by default, to make things easy and avoid having people to trust that certain certificate (that is different on each device), SSL certificate of the remote device in the application is not getting validated at all.

My question is, should users of such application be warned about this fact, when turning on the HTTPS mode? Or no, because when you say HTTPS, you primarily mean encryption and not authentication (which on local network can be achieved by some other ways, like EAP)?

Improve this question

1 Answer 1

Reset to default
2

Encryption is only useful, if the information is only encrypted for the intended party. Certificate validation in HTTPS ensures exactly this, i.e. that the encryption is established with the expected server and not with some man in the middle. Therefore it is a bad idea to completely disable certificate validation.

And using self-signed certificate does not actually require to completely disable certificate validation. One way is to provide the certificate to the client before connecting so that it can be imported as trusted. Another way is to "TOFU" (Trust On First Use), i.e. connect to the server, accept the certificate after the issued warning and then remember this certificate as the expected one for future connections. This is what browsers do. And in company environments it is often expected that administrators can use certificates issued by their internal PKI for the device, so that no certificate warnings need to be skipped.

Improve this answer
2
  • thank you, the TOFU concept seems nice for this situation.
    – user10099
    Commented Feb 19, 2022 at 12:46
  • I am aware of loss of the authentication when certificate is not validated at all, I was just wondering that in situations, where this is the only solution (due to some organizational, business restrictions ..), that whether end user of such application should be warned about the fact, that the certificate is not validated at all, when offering him the possibility to turn on HTTPS. But that is probably too general question to ask and depends on the nature of the application and what environments is the application used in.
    – user10099
    Commented Feb 19, 2022 at 12:52

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .