Today I tried to add the following openid to my stackoverflow account: https://thejh.net. However, it failed with this error message:

Unable to log in with your OpenID provider:

No OpenID endpoint found.

Just thejh.net works fine. Could this be because your servers don't accept cacert SSL certificates? If so, how about adding cacert to your list of trusted CAs?

  • 2
    That site only works because you included their root cert...no major browser or OS includes their root cert. Given that, I'm not really comfortable trusting it either. – Nick Craver Mar 10 '13 at 18:00
  • I agree, @Nick, but maybe you don't have to trust it? Maybe it would be sufficient that the server just does the SSL/encryption part, leaving the certificate trust steps only being handled by the browser? (If an untrusted certificate of a man-in-the-middle's fake OpenID provider makes the browser stop, and hence would not complete the authentication chain, then what harm could have been done if your server would have been sending things to the faked OpenID provider?) Just thinking out loud here; it surely doesn't feel good to relax security in part of the chain. – Arjan Mar 10 '13 at 21:25
  • @NickCraver: I would consider Debian to be a major distribution. – thejh Mar 10 '13 at 23:12
  • @thejh - it has quite a few users...but percentage-wise we're still talking a insignificant amount of trust for this CA. – Nick Craver Mar 10 '13 at 23:26
  • @Arjan - how do we know we're talking to the right server? We're being thrown a red flag that something is wrong with who we're talking to, that they're not presenting a valid cert. We need to stop when that happens, otherwise what's the point of SSL trust? – Nick Craver Mar 10 '13 at 23:29
  • Sure, @Nick, but HTTPS is both certificate trust and SSL encryption. Indeed you would not know you're talking to the right server, but I'm wondering how bad that is, since the same trust validation is done in some other steps of the chain. (That said, I guess I would do the same as you.) – Arjan Mar 11 '13 at 5:55

You must log in to answer this question.

Browse other questions tagged .