995017 - Allow site operators to provide some limited information on why they are using a self-signed certificate

Status: NEW

(Firefox :: Security, enhancement)

Description

[ar.cameron]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.8; rv:30.0) Gecko/20100101 Firefox/30.0 (Beta/Release)
Build ID: 20140325004002

Steps to reproduce:

Any self-signed certificate will display an ugly warning.  Further, any points of error or failure are not immediately obvious; e.g., the certificate claims to be for foo.bar.com and is used on baz.bar.com -- a bulleted list or table of the diff (seen in cert vs. expected) would be amazing for users.  Many will get scared and leave the site (in self-signed scenario), or confirm a security exception in error as a result.



Expected results:

I think that site operators should be able to supply some limited information, even if it's purely ASCII text, as to why they chose to use a self-signed certificate.  Having an HTTP site explaining this and acting as a portal to the HTTPS site is perhaps the only feasible solution at the moment, but it's hardly convenient.

My thought is that operators could describe why they chose not to use a CA (perhaps, a PGP-signed statement with the fingerprint of the certificate they intended) or a URL to another secure channel where they can verify the certificate in question.

I think there's definitely room for discussion here as to what we can do to make it a better experience to not depend so much on CAs, who have lately proven not to be the most reliable choice anyway.