Check in Javascript if a SSL Certificate is valid

Question

Hi.

Is there a way to check in Javascript if given a host it's SSL certificate is valid? (non blocking)

In my case I want to display: "you can also use https://.." if via javascript I can make a request to https://my_url without being asked to accept an untrusted certificate.

Can this be done asynchonously?

-- M.

Answer 1

The question doesn't make sense. You can't get the server's SSL certificate without opening an SSL connection to it, and once you've done that, telling the user they can do that too is a bit pointless.

Answer 2

The straight answer is no. Javascript does not provide any means of validating certificates. This is a job left to the browser.

A better approach to this problem is from the server side. If you are controlling the site, than you can render down a variable on the page with information gleaned on the server side.

In .Net something like

var canSecure = <%= MySiteHasSsl ? "true" : "false" %>;
if (canSecure) {
    if (confirm("This site supports SSL encryption. Would you like to switch to a secure connection?")) {
        location.href = "https://mysite.com";
    }
}

Answer 3

I'm not quite sure what your use case is. If you are just trying to "check ahead of time" before you provide a link to someone for another website then the other answers here will be more relevant than mine.

If you are expecting mysite.com to use an SSL certificate that isn't trusted by default in the browser but you have another way of knowing it should be trusted, then you could use a JavaScript TLS implementation to make cross-domain requests to that other site. However, this requires that your website be served on https and trusted in the browser to begin with and the other site to provide a Flash cross-domain policy file.

If this sounds anything like what you want to do, check out the opensource Forge project:

http://github.com/digitalbazaar/forge/blob/master/README

Answer 4

Looking at ARP Poissoning and man-in-the-middle-attack with ssl sessions I would like to get some information on the certificate being used on the web browser using javascript to warn or block the connection if the certificate doesn't match.

This makes sense on you?

Could it be possible?

Answer 5

What I've found up to now - it is possible with Firefox, don't know yet about other browsers:

https://developer.mozilla.org/En/How_to_check_the_security_state_of_an_XMLHTTPRequest_over_SSL