__TOC__ =Certificate and Certificate Hierarchy= When you visit a website whose web address start with https, the website presents a Secure Website Certificate to identify itself. Firefox uses that certificate to verify that the website is controlled by who it claims to be. After successful authentication of the website, Firefox uses the certificate to encrypt the communication between you and the website. A certificate is a signed assertion of an identity and other attributes related to this identity. This is similar to a driver's license or a passport. Additionally, this assertion must be signed by a Certificate Authority (CA) that Mozilla trusts to issue Secure Website Certificates only after taking appropriate steps to confirm ownership of the web address. An https website is only secure to the extent that the website is operated by someone in contact with the person who registered the domain name, and the communication between you and the website is encrypted to prevent eaves dropping. No other surety is implied. When you visit a secure website, Firefox will validate the website’s certificate by checking that the certificate that signed it is valid, and checking that the certificate that signed the parent certificate is valid and so forth up to a [https://wiki.mozilla.org/CA:UserCertDB root certificate] that is known to be valid. This chain of certificates is called the Certificate Hierarchy. =Certificate Contents= Secure Website Certificates contain the following information. '''Subject''': Identitifies the certificate owner, such as the name of the organization owning the certificate. '''Issuer''': Identifies the entity that issued the certificate. '''Subject Alt Name Extension''': List of website addresses that the certificate can be used to identify. '''Signature''': Data that verifies that the certificate came from the Issuer. '''Signature Algorithm''': Algorithm used to create the Signature. '''Serial Number''': Uniquely identifies the certificate. '''Valid-From''': The date the certificate first asserts the identity. '''Valid-To''': The last date when the certificate can be considered valid. '''Key-Usage and Extended Key Usage''': Specifies how the certificate may be used, such as for confirming ownership of a website (Web Server Authentication). '''Public Key''': The public part of the data that comprises the public/private key pair. The public and private keys are mathematically linked, so the data encrypted with the public key can only be decrypted with the corresponding private key. '''Public Key Algorithm''': Algorithm used to create the Public Key. =View a Certificate= When you have browsed to a website whose web address starts with https, there will be a lock icon at the begining of the address bar. Single-click on the lock icon to get a pop-up that says who verified the certificate, then click on {button More Information...}. In that window click on '''Security''' then {button View Certificate}. =Problematic Certificates= When you browse to a website whose web address starts with https, if there is a problem with the Secure Website Certificate, you will see the [https://support.mozilla.org/en-US/kb/connection-untrusted-error-message This Connection Is Untrusted] alert page. Some common errors are described [https://support.mozilla.org/en-US/kb/connection-untrusted-error-message#w_technical-information here]. To view the problematic certificate, follow these steps: # On the warning page, click '''I Understand the Risks'''. # Click {button Add Exception...}. The Add Security Exception dialog will appear. # Click {button View...}. The Certificate Viewer dialog will appear. =Reporting Certificate Errors= After you encounter an Untrusted Connection error, you may see a popup window asking you to report the error to Mozilla. Sharing the address and site identification (the Secure Website Certificate) for the site that was untrusted will help us identify and block malicious sites to keep you better protected. [[Template:ShareArticle|link=http://mzl.la/1cvhneK]]

Certificate and Certificate Hierarchy

When you visit a website whose web address start with https, the website presents a Secure Website Certificate to identify itself. Firefox uses that certificate to verify that the website is controlled by who it claims to be. After successful authentication of the website, Firefox uses the certificate to encrypt the communication between you and the website.

A certificate is a signed assertion of an identity and other attributes related to this identity. This is similar to a driver's license or a passport. Additionally, this assertion must be signed by a Certificate Authority (CA) that Mozilla trusts to issue Secure Website Certificates only after taking appropriate steps to confirm ownership of the web address.

An https website is only secure to the extent that the website is operated by someone in contact with the person who registered the domain name, and the communication between you and the website is encrypted to prevent eaves dropping. No other surety is implied.

When you visit a secure website, Firefox will validate the website’s certificate by checking that the certificate that signed it is valid, and checking that the certificate that signed the parent certificate is valid and so forth up to a root certificate that is known to be valid. This chain of certificates is called the Certificate Hierarchy.

Certificate Contents

Secure Website Certificates contain the following information.

Subject: Identitifies the certificate owner, such as the name of the organization owning the certificate.

Issuer: Identifies the entity that issued the certificate.

Subject Alt Name Extension: List of website addresses that the certificate can be used to identify.

Signature: Data that verifies that the certificate came from the Issuer.

Signature Algorithm: Algorithm used to create the Signature.

Serial Number: Uniquely identifies the certificate.

Valid-From: The date the certificate first asserts the identity.

Valid-To: The last date when the certificate can be considered valid.

Key-Usage and Extended Key Usage: Specifies how the certificate may be used, such as for confirming ownership of a website (Web Server Authentication).

Public Key: The public part of the data that comprises the public/private key pair. The public and private keys are mathematically linked, so the data encrypted with the public key can only be decrypted with the corresponding private key.

Public Key Algorithm: Algorithm used to create the Public Key.

View a Certificate

When you have browsed to a website whose web address starts with https, there will be a lock icon at the begining of the address bar. Single-click on the lock icon to get a pop-up that says who verified the certificate, then click on More Information.... In that window click on Security then View Certificate.

Problematic Certificates

When you browse to a website whose web address starts with https, if there is a problem with the Secure Website Certificate, you will see the This Connection Is Untrusted alert page. Some common errors are described here.

To view the problematic certificate, follow these steps:

1. On the warning page, click I Understand the Risks.
2. Click Add Exception.... The Add Security Exception dialog will appear.
3. Click View.... The Certificate Viewer dialog will appear.

Reporting Certificate Errors

After you encounter an Untrusted Connection error, you may see a popup window asking you to report the error to Mozilla. Sharing the address and site identification (the Secure Website Certificate) for the site that was untrusted will help us identify and block malicious sites to keep you better protected.