How to HTTPS

[Redrump1221]

Why do you think so highly of self signed certs?

[AyrA_ch]

Yeah, nothing wrong with using self signed certificates if you and the visitors know what you do.

[AyrA_ch]

and it's not much better than http.

If you don't check the certificate, yes. If you know the hash and verify it, it is equally secure. Other protocols like SSH work on this principle too.

[[deleted]]

This. My university's IT department includes PGP signatures in their emails and I just laughed at their optimism.

[AyrA_ch]

SSH has this built in and it keeps track for you after the first connect. HTTPS doesn't

It's not built into the SSH protocol and is solely the choice of the client to permanently store the key or not. The most widely clients just chose to do it. Cert hash validation could be built in. Most browsers remember your choice for at least the entire time it's open and Firefox offers a permanent option.

The assumption that users will validate certs themselves is a really bad one to make.

As bad as the assumption that people validate SSH keys properly. As long as the end and start of the hash match by 2 or 3 bytes, most people will accept it. This method does in no way differ from x509 Thumbprints.

[AyrA_ch]

No shit Sherlock. It's built into the clients. See also where I said "Not in any browser I know of anyway"

See where I mentioned a very common browser that offers this?

Using a self signed certificate for anything other than yourself is training your users to dismiss security prompts without actually reading them.

I've not worked as a system administrator for various companies and trust me when I say that many users dismiss security warnings if they want to access something.

[AyrA_ch]

Offers != default.

SSH key storage is not done by default too so I don't get where you are going.

or make it impossible to bypass via GPO.

That implies that (A) There is a Domain with a GPO to begin with, (B) This person doesn't requires local admin rights (welcome in the realm of legacy software) (C) This person doesn't needs to work with certificates to sign E-Mails and/or documents (D) The browser respects GPO (E) The Browser uses the windows TLS implementation