Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

To monitor my network traffic in OSX, I'm using the firewall HandsOff! by Metakine. I've noticed that Thunderbird connects only on port 80 (http) when checking for updated certificates.

Is this normal?

I've been using Thunderbird for several days now, and it never chose to establish secure connections on port 443 (https) when checking for certificates.

enter image description here

share|improve this question
Perhaps new certs are signed by old ones? After all, to use SSL you'd have to trust the old ones anyway. If so, not using SSL (in HTTPS) saves money and doesn't affect integrity of data substantially. – RedGrittyBrick May 18 '12 at 16:38
@RedGrittyBrick: Saves money? It's not like VeriSign has to buy SSL certificates... – grawity May 18 '12 at 17:28
@grawity: I was recalling the arguments that Zypher gave for not using HTTPS on SE websites. ... – RedGrittyBrick May 18 '12 at 17:31
@grawity: Though Jeff Attword appears to have changed his mind on this. My speculation may be wrong or OTOH Mozilla/Verisign et al may not have caught up with Jeff's thinking. – RedGrittyBrick May 18 '12 at 17:41
up vote 2 down vote accepted

As your screenshot shows, Thunderbird creates the connections to retrieve CRLs and to verify certificate status using OCSP. In both cases, SSL is not necessary to ensure security, since X.509 revocation lists and OSCP responses are always signed by the same CA.

share|improve this answer

In some ways this is a chicken and the egg. If the browser wanted to verify a certificate over an SSL, connection, then it would also have to verify the certificate of the SSL connection, but how could it verify the certificate of that SSL connection?

So if I go to then I need to verify the cert using OCSP, so I connect to the OCSP server defined in the certificate. If I tired to connect to the OCSP server using HTTPS, then I would need to verify the certificate of the OCSP server, but where do I go to verify that?

As @grawity, mentioned, encryption isn't required to keep the cert verification in the clear, since the PKI used for certificates already prevents any issues.

share|improve this answer

You must log in to answer this question.