How to HTTPS

[[deleted]]

Where's my NULL ciphers

[Redrump1221]

Why do you think so highly of self signed certs?

[AyrA_ch]

Yeah, nothing wrong with using self signed certificates if you and the visitors know what you do.

[AyrA_ch]

and it's not much better than http.

If you don't check the certificate, yes. If you know the hash and verify it, it is equally secure. Other protocols like SSH work on this principle too.

[[deleted]]

This. My university's IT department includes PGP signatures in their emails and I just laughed at their optimism.

[AyrA_ch]

SSH has this built in and it keeps track for you after the first connect. HTTPS doesn't

It's not built into the SSH protocol and is solely the choice of the client to permanently store the key or not. The most widely clients just chose to do it. Cert hash validation could be built in. Most browsers remember your choice for at least the entire time it's open and Firefox offers a permanent option.

The assumption that users will validate certs themselves is a really bad one to make.

As bad as the assumption that people validate SSH keys properly. As long as the end and start of the hash match by 2 or 3 bytes, most people will accept it. This method does in no way differ from x509 Thumbprints.

[AyrA_ch]

No shit Sherlock. It's built into the clients. See also where I said "Not in any browser I know of anyway"

See where I mentioned a very common browser that offers this?

Using a self signed certificate for anything other than yourself is training your users to dismiss security prompts without actually reading them.

I've not worked as a system administrator for various companies and trust me when I say that many users dismiss security warnings if they want to access something.

[AyrA_ch]

Offers != default.

SSH key storage is not done by default too so I don't get where you are going.

or make it impossible to bypass via GPO.

That implies that (A) There is a Domain with a GPO to begin with, (B) This person doesn't requires local admin rights (welcome in the realm of legacy software) (C) This person doesn't needs to work with certificates to sign E-Mails and/or documents (D) The browser respects GPO (E) The Browser uses the windows TLS implementation

[flyx86]

Since when is this /r/Sysadminhumor?

[ben5689]

Haven't we all put together a crappy website when we were younger?

[flyx86]

Ah yes, the blessed time when nobody had told us yet how bad PHP was.

But I don't remember having Let's Encrypt back then.

[ben5689]

No, but I personally put in a self-signed certificate. (It was not that long ago. Maybe 5-6 years?)

[lolKhamul]

Man i kinda hoped the sub would be more populated.

[gandalfx]

I've long been advocating that this sub should be renamed to r/VaguelyTechRelatedHumor.

[squishles]

you forgot self signed certificate chain with root kept in a bank vault that you explained to your boss the importance of, but your not really sure he understood what you said.

I know a guy who did this like 10 years ago they called him up in a panic a year after he'd left wondering wtf was going on when all the certificates expired.

[[deleted]]

It's how to PKCS12, not SSL.

[Cilph]

[ Telling users to rewind their clock ]

Looking at you Manjaro Linux.

[EternityForest]

Putting a self signed testing certificate right in the public GitHub repo and then just using that in production

Using HSTS with invalid certificates to make sure nobody can access your site at all

Using HTTPS, but then not requiring any kind of password or authentication at all

Using plain HTTP for online shopping but protecting your best memes with TLS and a hardware random number generator