Re: Moving forward on improving HTTP's security

On Thu, Nov 14, 2013 at 10:52 AM, Julian Reschke <julian.reschke@gmx.de>wrote:

> So how does my home router get a certificate? In particular, if I need to
> configure it first to connect to the internet?
>
> Best regards, Julian
>

Off the top of my head, here's a couple ways (by no means an exhaustive
list, and by no means are these guaranteed to be the best options):

1. Comes with one from the vendor. The program CD (or USB stick or
whatever) used to do configuration can be specially configured to know
about the otherwise invalid cert being used.
2. First-time setup happens over an unencrypted HTTP/1.1 channel (which is
probably ok, as chances are you're going to be plugged directly into the
router at this point, and as you said - you're likely not connected to the
internet) which then generates a cert and has you install it in your
browser, allowing you to use the secure channel in the future.

All that said, I'm not a UX designer or anything like that, so I'm sure
there would be some rough edges around these workflows, but I'm confident
that we (and UX designers) are smart enough to solve those kinds of issues.