Skip to content
Snippets Groups Projects

Improve documentation on Onion Services and HTTPS

Open Silvio Rhatto requested to merge rhatto/support:hotfix/onion-icon into main
4 unresolved threads
1 file
+ 9
2
Compare changes
  • Side-by-side
  • Inline
@@ -8,9 +8,16 @@ description:
When browsing an Onion Service, Tor Browser displays different onion icons in the address bar indicating the security of the current webpage.
![Image of an onion](/static/images/onion-site.png)
An onion means:
- The Onion Service is served over HTTP, or HTTPS with a CA-Issued certificate.
An onion means either that:
- The Onion Service is served over HTTPS with an Extended Validation certificate.
That means a Certificate Authority (CA) has checked that the site really belongs to the entity it claims to belong.
- The Onion Service is served over HTTPS with a Domain Validated (DV) certificate.
That means the HTTPS certificate was issued by a Certificate Authority (CA), but without checking if the site really belongs to the entity it claims to belong, i.e, the onion icon does not provide the information that you're on the "right site".
- The Onion Service is served over HTTPS with a Self-Signed certificate.
    • Author Maintainer

      Tor Browser 13.0.1 seems not to be following this spec closely.

      I'm getting an onion icon with caution sign when accessing an Onion Services with a self-signed HTTP certificate.

      Shall we update the specs or leave at it is and notify the Applications Team somewhere?

Please register or sign in to reply
The certificate was not signed by a Certificate Authority (CA) that is recognized as a "trusted" authority, and the certificate provides no information about whether the site really belongs to the entity it claims to belong.
- The Onion Service is served over HTTP.
This is not a security issue, since the Onion Service protocol is already end-to-end encrypted.
In this case, the icon does not provide information that you're connected to the "right site".
![Image of an onion with a red slash](/static/images/onion-site-broken.png)
An onion with a red slash means:
Loading