up vote 3 down vote favorite
share [g+] share [fb]

On a domain like truecrypt.org, you cannot see the actual website trough https, but when you download the signatures of their files or their pgp key, they will send it to you through https. However firefox does not seem to give me the possibility to look at the certificate in this situation.

What is a practical way of looking at the certificate, preferably without having to install extra tools...

link|improve this question
38% accept rate
How are you downloading the signatures, through Firefox or another tool? Also, are you wanting to view the certificate of the signature you've downloaded? Please clarify your question. – ultrasawblade Nov 17 '11 at 20:06
@ultrasawblade You can view SSL certificate information by clicking the publisher's name on the left of the address bar and then selecting More information…. It looks like this. But for this to work in Firefox, you need to have an actual web page open. – Daniel Beck Nov 17 '11 at 20:12
Im sorry, im not very good at formulating well, but i have specifically included the link so you can see for yourself. the files like signatures and their pgp key are on their download page. – ufotds Nov 17 '11 at 20:23
feedback

2 Answers

up vote 3 down vote

I was able to get this info using curl, available for Windows/Linux/Unix/MacOS etc.:

curl -v https://www.truecrypt.org

* SSL connection using TLS_DHE_RSA_WITH_AES_256_CBC_SHA
* Server certificate:
*       subject: CN=www.truecrypt.org,OU=Domain Control Validated,O=www.truecrypt.org
*       start date: Apr 10 12:41:56 2009 GMT
*       expire date: Apr 10 12:41:56 2012 GMT
*       common name: www.truecrypt.org
*       issuer: serialNumber=07969287,CN=Go Daddy Secure Certification 
Authority,OU=http://certificates.godaddy.com/repository,O="GoDaddy.com, 
Inc.",L=Scottsdale,ST=Arizona,C=US

(most output cut out for brevity)

I consider this issue (that you cannot see this using standard browser tools) a serious security issue for truecrtypt web site.

SSL serves two purposes: encryption and authentication. In this specific case, encryption is not important at all, and authentication is very important. And they:

  1. Use lowest-grade certificate, that really just proves that someone who can access admin@truecrypt.org or similar address bought that cert.

  2. Won't let the user see the certificate easily, therefore verifying the certificate is problematic for most users.

link|improve this answer
feedback
up vote 2 down vote

If you want to see the cert using Firefox for example, you need to turn off redirection.

The https://www.truecrypt.org site does a 301 (permanent) redirection to http://www.truecrypt.org.

Browsers / proxies appear to take this very seriously, and will cache a 301 such that any subsequent visits go direct to the redirected address.

In firefox you can do

  1. Clear cache
  2. Disable cache in about:config, set browser.cache.memory.enable and browser.cache.disk.enable to false
  3. Go to Options / Advanced / General and check Warn when redirecting

Now if you do all of this, and then go to https://www.truecrypt.org, it should stay there with a warning that it wants to redirect. But then you can view the cert in the normal way.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.