APPENDIX4APPENDIX 4 – Browser CertificatesYou shouldn't overestimate the I.Q. of crooks — NYT: Stuart A. Baker, General Counsel for the NSAThere is no security on this earth. Only opportunity. – Douglas MacArthurCertificatesCertificates are means for authenticating the validity of sites, servers or other devices usercan connect to for services. These include web servers, print servers, data services and more.Normally, users encounter the certificates when they sign on to web services.One of the common methods of compromising the security is to create phishing sites.Phishing sites look like the real web site and extract information from a valid user whichthem compromises the security of the user (typically impersonating the individual to accessinformation or money or other services faking their identity). This is commonly used tocompromise security (and hence the quotes at the beginning of this appendix….)Many devices as well as web sites, today use secure methods to communicate via the web.Once secure web communications are required, the browsers look at the certificate andmatch the URL information to the certificate information. If the information does notmatch, the browser flags the site as a compromised site.Certificates allow a user accessing a web site to authenticate whether they are in fact on theproper web site. To do that, there are Certificate Authorities who validate the authenticity ofthe site and can issue a public certificate. This process usually costs money and time invalidation etc.Many devices use self signed certificates. Self signed certificates allow a vendor to insert in a“signature” to identify their device and other parameters. Many times, the user accessing thedevice will find that the device they are accessing and the self signed certificate do notmatch. The browser will typically catch that and will warn a user about accessing the site.The rest of the sections below will describe how to use the browsers with GarrettCom selfsigned certificates.328
