While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection, and to avoid HTTP connections. Users would need to click and do a manual verification, and that would show that they're visiting the onion site that they're expecting.Īlternatively, websites can provide other ways to verify their onion address using HTTPS, for example, linking their onion site address from an HTTPS-authenticated page, or using Onion-Location.Īnother topic of this discussion is user expectations and modern browsers. We compiled some topics and arguments, so you can analyze what's the best for your onion site:Īs anyone can generate an onion address and its 56 random alphanumeric characters, some enterprise administrators believe that associating their onion site to an HTTPS certificate might be a solution to announce their service to users. That said, there are some specific cases where you would need or want to have an HTTPS for your onion site.

HARICA with Domain Validation (DV) TLS certificates.DigiCert with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization.Right now, HTTPS certificates are only provided by: No certificate authority is required for this proof, because the name of the service is the actual public key used to authenticate the underlying connection.Īs '.onion' is a special top level domain name, most Certificate Authorities don't have support for issuing X.509 certificates for onion sites. When visiting a site over the Onion Services protocol, the Tor protocol prevents data in transit from being read or manipulated by man in the middle attacks, and the Onion Service protocol validates that the user is connected to the domain name in the browser address bar. Modern browsers indicate that a connection is insecure if not using TLS, and require that a TLS connection is authenticated by a CA-issued x.509 certificate. When visiting a site over HTTPS (HTTP over TLS), the TLS protocol prevents data in transit from being read or manipulated by man in the middle attacks, and an x.509 certificate obtained from a Certificate Authority (CA) validates that the user is actually connecting to a server representing the domain name in the browser address bar.

Onion tor index