10

According to Apple,

With Safari 5 through 5.1.7, a lock icon appears near the top right corner [only] if all of the webpage's content uses a secure connection.

That's all very well, but normally to view the SSL/TLS certificate for a webpage serving content over HTTPS, one would click the padlock icon.

Because the icon is not present on pages that serve only some of their content over SSL/TLS, there ought to be another way to view the certificate, but what is it?

10

Recent versions of Safari do not appear to display the lock icon or certificate unless all content loaded by the page is https. For example, if the page URL is https but it loads a JavaScript file via http, no lock icon.

The only workaround I've found so far is to run the openssl command in Terminal, like this:

echo ^d | openssl s_client -connect host.example.com:443

This will show you the certificate chain back to whatever root authority is used to sign, if any. "verify error" will show things like "self signed certificate".

1

If you request a single asset, such as an image on the site, over HTTPS then Safari will show you the padlock.

For example, choose an image on the page you are looking at, Ctrl-click/Right-click the image, choose to view that image in a new Tab. In the new tab the content you are viewing isn't mixed because it is a single element and Safari will show you the padlock.

0

If a website is serving some content over HTTPS and some over HTTP then you shouldn't trust it. It's that simple. It doesn't matter what certificate it is using for the secure parts.

If part of the content is being loaded over an insecure connection then you don't know if it has been interfered with, and you don't know if it is interfering with the securely delivered parts.

There are various security experts who write on this subject. Troy Hunt is one who springs to mind right now. You can find a pertinent article here and others on related topics here.

  • 3
    What you say is true, but my question was about viewing certificates, not about whether to trust a website. – sampablokuper Aug 6 '14 at 22:54
  • Sorry but Safari doesn't appear to give you an option that will show a certificate on a mixed content website. Firefox does though. Just hit CMD-I and select the Security tab. – Alistair McMillan Aug 6 '14 at 23:14

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .