SSL 的优点值得这么麻烦吗？
当前在 http://www.spothero.com 上使用 Godaddy SSL
在朋友的 iPhone 上显示“无法验证服务器” 我认识
的两个人无法从他们的黑莓手机访问它，甚至在计算机上的浏览器上也会不断出现服务器身份问题。
SSL 的优点值得这么麻烦吗？完全摆脱 HTTPS 连接会有什么缺点？
Currently using a Godaddy SSL on http://www.spothero.com
On a friend's iphone it said "cannot verify server identity"
Two people I know cannot access it from their blackberrys and server identity problems keep popping up even on browsers on computers.
Are the advantages of SSL worth this hassle? What would be the downside of completely getting rid of the HTTPS connection?
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（4）
实际上有一种众所周知的（如果没有广泛实践的话）方法来处理这个问题。
回想一下，风险的数学定义是
其中 R 是风险，P 是概率坏事发生的概率，H 是危险，即坏事发生时的成本。
估算一下错误的披露会给您带来多少货币损失。计算出有人尝试（从疯狂猜测到仔细分析）并成功的概率，然后您就可以计算R。
R 是否低于解决 SSL 问题的成本？如果是这样，那就不值得付出努力。
也就是说，您收到的投诉意味着您用于 SSL 的证书未由已知的可信来源（例如 Verisign）签名。如果 GoDaddy 向您出售了 SLL 和证书，那么这对他们来说就是一个技术支持问题。否则，您需要购买可验证的证书。
There's actually a well-understood (if not widely practiced) way to handle this question.
Recall that the mathematical definition of risk is
where R is the risk, P is the probability of the bad thing happening, and H is the hazard, ie, the cost of that bad thing if it happens.
Make an estimate of how much a bad disclosure could cost you, in currency. Figure out the probability that someone would try it (anything from a wild-ass guess to a careful analysis) and succeed, and you can compute R.
Is R less than the cost of solving your SSL problem? If so, it's not worth the effort.
Now, that said, the complaint you're getting means the certificate you're using for your SSL is not signed by a known trusted source, eg Verisign. If GoDaddy sold you the SLL and cert, then it's a tech support problem for them. Otherwise, you need to buy a verifiable cert.
要使证书被视为对 Web 有效，它必须：
您可能看到的问题是相关的根据最后一项要求，您的证书是由 GoDaddy 证书颁发机构 (CA) 颁发的，因此访问您网站的“系统”必须了解并信任该证书。
Windows 和其他操作系统预先捆绑了一整套预先信任的 CA 证书，因此这些系统的用户将能够访问您的站点而不会出现任何警告（除非他们不信任 CA）。黑莓/iPhone 操作系统很可能没有预先信任的 GoDaddy CA 证书，因此用户必须手动添加此证书（大多数用户不知道如何做）
这解释了您所看到的问题，至于“麻烦”的问题，很大程度上取决于 Spothero 上线后会做什么。如果它要求用户提交私人/个人/敏感信息，那么在提交/显示此数据时，它应该有一个 HTTPs 组件。如果 Spothero 永远不会使用私人等信息，那么您实际上并不需要 SSL。
因此，回到问题的原因，如果您确定确实需要 SSL（让用户安心），请考虑使用更知名的证书颁发机构，例如 Verisign 或 Thwaites。
For a certificate to be considered valid for web it must:
The problem you are likely seeing is related to the last requirement, your certificates are issued from the Go Daddy certificate authority (CA) and therefore the "system" accessing your site must be aware of and trust that certificate(s).
Windows and other operating systems come pre bundled with a whole load of CA certificates pre trusted so users of these systems will be able to access your site without any warnings (unless they have untrusted the CA). The chances are the blackberry / iphone operating system do not have the Go Daddy CA certs pre trusted so a user would have to add this manually (something the vats majority of users will not know how to do)
That explains the issues you are seeing, as for the "hassle" question that largely depends on what Spothero will be doing when it goes live. If it requires users to submit private/personal/sensitive information then yes it should have an HTTPs component when this data is being submitted/displayed. If Spothero will never use private etc information then you don't really need SSL.
So going back to the cause of your issue, if you decide you really need SSL (to give your users peace of mind) then consider using better known Certificate Authority such as Verisign or Thwaites.
如果您要发送敏感数据（例如用户名和密码），SSL 非常重要。
我看到你的证书的验证机构是GoDaddy本身，可能不太受欢迎。更好的选择可能是选择 Verisign 或 Thawte。
SSL is important if you're sending sensitive data across, such as usernames and passwords.
I see that your certificate's verifying authority is GoDaddy itself, which may not be so popular. A better option might be to go for Verisign's or Thawte's.
随着 FireSheep 等工具的广泛使用，如果您使用公共 WiFi 网络，那么使用 SSL 就变得极其重要。通过复制会话 cookie 来窥探和冒充用户非常容易。
With the widespread usage of tools like FireSheep, it's extremely important to use SSL if you ever use public WiFi networks. It's extremely easy to snoop and to impersonate users by copying their session cookies.