Secure website certificates

A TLS certificate proves two things about a site whose address starts with https: that whoever runs it controls the domain name, and that the traffic between you and it cannot be read or altered in transit.

The chain of trust

Waterfox verifies a certificate through a hierarchy, usually of three:

The root certificate, the trust anchor, belonging to a Certificate Authority (CA).
One or more intermediate certificates.
The server certificate presented by the site.

Certificates rely on asymmetric cryptography. The private key stays secret with its owner and signs data; the matching public key is published and verifies those signatures.

How Waterfox verifies a certificate

It downloads the certificate the site presents.
It checks the chain against its built-in database of trusted CAs, following the signatures from the root down to the server certificate.
It confirms the site you asked for matches one the certificate is valid for.
It negotiates a symmetric key for the session, encrypted with the server’s public key.
The server decrypts that with its private key, completing the TLS handshake.

Revocation: how Waterfox differs

Certificates are sometimes revoked before they expire. Firefox has historically checked this per-site with an OCSP request to the issuing CA — which tells that CA which sites you are visiting.

Tip

Waterfox sets security.OCSP.enabled to 0. Revocation is handled by CRLite data delivered with the browser instead, so Waterfox does not contact a Certificate Authority about the sites you visit. See the Privacy Policy.

View a certificate

Select the icon at the left of the address bar.
Select the connection entry in the panel that opens.
Select More site information.
In the Page Info window, select View Certificate.

The about:certificate page opens with a tab for each certificate in the chain: server, intermediate and root.

What a certificate contains

Subject — the site name and any organization details.
Issuer — the CA that issued it.
Validity — the period it is good for.
Subject Alt Name — every address the certificate covers.
Public Key Info — the algorithm and key.
Serial Number — unique per issuer.
Signature Algorithm — how the signature was produced.
Fingerprints — hashes of the certificate, useful for verifying one out of band.
Key Usage and Extended Key Usage — what the certificate may be used for.
Subject Key ID and Authority Key ID — identifiers linking a certificate to its issuer.
CRL Endpoints and Authority Info — where revocation and issuer data live.
Certificate Policies — what was verified at issuance.
Embedded SCTs — Certificate Transparency timestamps proving the certificate was publicly logged.

When something is wrong

If a certificate fails verification, Waterfox shows a warning page instead of loading the site. To inspect the certificate:

Select Advanced on the warning page.
Select View the site’s certificate.

Treat these warnings seriously on any site where you would type a password or card number. A warning on a public Wi-Fi network in particular can mean someone is intercepting the connection.

Adapted for Waterfox from the original Firefox article Secure website certificate. Original content by Mozilla Contributors. Licensed under the CC BY-SA 3.0.