commit a730de4c19b2b6a4d03293afa4ac511c75fd815f Author: gus gus@torproject.org Date: Fri Dec 18 17:01:17 2020 -0500
Add https for you onion page. Fix #130 --- content/onion-services/advanced/https/contents.lr | 70 +++++++++++++++++++++++ 1 file changed, 70 insertions(+)
diff --git a/content/onion-services/advanced/https/contents.lr b/content/onion-services/advanced/https/contents.lr new file mode 100644 index 0000000..04c249c --- /dev/null +++ b/content/onion-services/advanced/https/contents.lr @@ -0,0 +1,70 @@ +section: advanced configuration +--- +section_id: onion-services +--- +color: primary +--- +_template: layout.html +--- +title: HTTPS for your onion service +--- +subtitle: Learn why some onions have TLS certificates. +--- +key: 4 +--- +html: two-columns-page.html +--- +body: + +When visiting a site over HTTPS (HTTP over TLS), the TLS protocol prevents data in transit from being read or manipulated by man in the middle attacks, and an x.509 certificate obtained from a Certificate Authority (CA) is validates that the user is actually connecting to a server representing the domain name in the browser address bar. +Modern browsers indicate that a connection is insecure if not using TLS, and require that a TLS connection is authenticated by a CA-issued x.509 certificate. + +When visiting a site over the onion services protocol, the Tor protocol prevents data in transite from being read or manipulated by man in the middle attacks, and the onion service protocol validates that the user is connected to the domain name in the browser address bar. +No certificate authority is required for this proof, because that name is the actual public key used to authenticate the underlying connection. + +As ".onion" is a [special top level domain name](https://tools.ietf.org/html/rfc7686), most Certificate Authorities don't have support for issuing X.509 certificates for onion sites. +Right now, HTTPS certificates are only provided by DigiCert with an Extended Validation (EV) TLS certificate, which means a considerable cost for an organization. + +That said, there are some specific cases where you would need or want to have an HTTPS for your onion site. + +We compiled some topics and arguments, so you can analyze what's the best for your onion site: + +1. As anyone can generate an onion address and its 56 random alphanumeric characters, some enterprise onions believe that associating their onion site to an HTTPS certificate might be a solution to announce their service to users. +Users would need to click and do a manual verification, and that would show that they're visiting the onion site that they're expecting. +Alternatively, websites can provide other ways to verify their onion address using HTTPS, for example, linking their onion site address from an HTTPS-authenticated page, or using [Onion-Location](https://community.torproject.org/onion-services/advanced/onion-location/). + +2. Another topic of this discussion is user expectations and modern browsers. +While there is extensive criticism regarding HTTPS and the CA trust model, the information security community has taught users to look for HTTPS when visiting a website as a synonym of secure connection and avoid HTTP connections. +Tor Developers and UX team worked together to bring a new user experience for Tor Browser users, so when a user visits an onion site using HTTP [Tor Browser doesn't display a warning or error message](https://support.torproject.org/onionservices/onionservices-5/). + +3. Some websites have a complex setup and are serving HTTP and HTTPS content. +In that case, just using onion services over HTTP could leak [secure cookies](https://github.com/alecmuffett/eotk/blob/master/docs.d/security-advisories.d...). +We wrote about [Tor Browser security expectations](https://blog.torproject.org/tor-brower-onion-services-challenges-opportuniti...), and how we're working on onion services usability and adoption. +There are some alternatives you might want to try to address this problem: + + * To avoid using an HTTPS certificate for your onion, the easiest answer is to write all your content so it uses only relative links. +Then the content will work smoothly no matter what website name it's being served from. + * Another option is to use webserver rules to rewrite absolute links on the fly. + * Or use a reverse proxy in the middle or more specifically EOTK with an HTTPS certificate. + +4. Related to the previous point, some protocols, frameworks, and infrastructures use SSL as a technical requirement; they won't work if they don't see an "https://" link. +In that case, your onion will need to use an HTTPS certificate in order to function. + +5. Actually HTTPS does give you a little bit more than onion services. +For example, in the case where the webserver isn't in the same location as the Tor program, you would need to use an HTTPS certificate to avoid exposing unencrypted traffic to the network in between the two. +Remember that there's no requirement for the webserver and the Tor process to be on the same machine. + +### What's next + +Recently in 2020, the Certificate Authority/Browser Forum voted and [approved version 3 onion certificates](https://archive.cabforum.org/pipermail/servercert-wg/2020-February/001637.ht...), so CAs are now allowed to issue Domain Validation (DV) and Organization Validation (OV) certificates containing Tor onion addresses. +In the nearby future, we hope that [Let's Encrypt](https://letsencrypt.org/) CA can start issuing v3 onion certificates for free. + +If you're going to purchase an HTTPS certificate be aware that [v2 onion service deprecation](https://blog.torproject.org/v2-deprecation-timeline) will happen between July - October 2021. + +### Read more + + * For a detailed step by step how to create an HTTPS onion certificate, check [Brave's blog post](https://brave.com/new-onion-service/). + * [Tor Browser and Onion Services - Challenges and Opportunities (2020)](https://blog.torproject.org/tor-brower-onion-services-challenges-opportuniti...) + * [Facebook, hidden services, and https certs (2014)](https://blog.torproject.org/facebook-hidden-services-and-https-certs) + * [DigiCert](https://www.digicert.com/blog/onion-officially-recognized-special-use-domain...) + * [The ".onion" Special-Use Domain Name - IETF RFC 7686](https://tools.ietf.org/html/rfc7686)