iframe 中的自签名 SSL 证书
我正在开发一个 Facebook 应用程序，遇到了安全浏览的问题。 Facebook 可以设置为安全浏览，与网站的所有交互都通过 HTTPS 进行。为了使应用程序在这种情况下可用（它通过 iframe 包含），我们需要自己提供一个安全的 URL。由于我们目前无法购买 CA 签名的证书，因此我们需要签署自己的证书。但是，当网站在此 iFrame 中显示时，安全异常根本不会显示或无法正确显示：在 Firefox 中，“添加异常”按钮不可单击，在 Chrome 中，我们会收到 501 错误消息。这是什么？这可以以某种方式解决吗？
请不要发表有关自签名证书多么不安全的评论。我知道这一点，而且我宁愿拥有一个“真正的”。目前这不是一个选择，因此签署我们自己的协议比将安全浏览人员完全排除在应用程序之外更好。
I am developing a facebook app and ran into the problem of secure browsing. Facebook can be set to secure browsing where all interaction with the website happens over HTTPS. To make the app usable in this case (it is included via an iframe), we need to provide a secure URL ourselves. Since we currently can't buy a CA signed certificate, we needed to sign our own one. However, when the website is displayed in this iFrame, the security exception is not at all or not correctly displayed: In Firefox the "Add Exception" button is not clickable and in Chrome we get a 501 error message. What is this? And can this be solved somehow?
Please do not post comment about how unsecure self-signed certificates are. I know that, and I would rather have a "real" one. This is just not an option at the moment, so signing our own is better than excluding secure browsing people totally from the app.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（2）
FireFox 在 Bug 742645 中特意删除了“我了解风险”部分。您可以通过右键单击 iframe -> 接受证书此框架 ->仅显示此框架，然后您将能够添加例外。
FireFox removed the "I Understand the Risks" section purposely in Bug 742645. You can accept the certificate by right-click on the iframe -> This Frame -> Show Only This Frame, then you will be able to add the exception.
我有同样的问题，但我的场景是在我的本地开发服务器上 - 我们有一个自签名的 SSL，但（至少在我的情况下）我每次打开新浏览器时都必须重新允许访问该 url。如果您直接访问应用程序的 URL，您应该会收到标准浏览器警告 - 类似以下内容（取自 chrome）：
一旦您确认要继续，您的应用程序应该按预期工作。
I have the same issue but my scenario is on my local development server - we have a self signed SSL but (at least in my case) i have to re-allow access to the url everytime i open a new browser. If you go directly to the URL of your app, you should get the standard browser warning - something like this (taken from chrome):
once you confirm that you want to proceed your app should work as expected.