1

I am developing a facebook app and ran into the problem of secure browsing. Facebook can be set to secure browsing where all interaction with the website happens over HTTPS. To make the app usable in this case (it is included via an iframe), we need to provide a secure URL ourselves. Since we currently can't buy a CA signed certificate, we needed to sign our own one. However, when the website is displayed in this iFrame, the security exception is not at all or not correctly displayed: In Firefox the "Add Exception" button is not clickable and in Chrome we get a 501 error message. What is this? And can this be solved somehow?

Please do not post comment about how unsecure self-signed certificates are. I know that, and I would rather have a "real" one. This is just not an option at the moment, so signing our own is better than excluding secure browsing people totally from the app.

1
  • I've never seen the issue you mention. Does your hosting provider allow for piggybacking their certificate? Heroku certainly does. Is migrating to Heroku an option? Dec 1, 2011 at 9:07

2 Answers 2

3

FireFox removed the "I Understand the Risks" section purposely in Bug 742645. You can accept the certificate by right-click on the iframe -> This Frame -> Show Only This Frame, then you will be able to add the exception.

1
  • 1
    thanks, this is a good workaround for use in a development environment rather than purchasing a 3rd-party signed ssl cert
    – Eddie
    Oct 19, 2014 at 7:43
1

I have the same issue but my scenario is on my local development server - we have a self signed SSL but (at least in my case) i have to re-allow access to the url everytime i open a new browser. If you go directly to the URL of your app, you should get the standard browser warning - something like this (taken from chrome):enter image description here


once you confirm that you want to proceed your app should work as expected.

3
  • When I open the address directly in the browser window I can accept the certificate and proceed to the app in facebook. However, my users will access it only through facebook, so this is not really an option...
    – janoliver
    Dec 1, 2011 at 10:36
  • not purchasing an SSL certificate is not really an option either. Facebook requires you to do it. If you are self signing your users ar the ones who are confirming that they trust your site.
    – Lix
    Dec 1, 2011 at 11:37
  • I am using this method only durring my development stage. Afterwards i'll transfer the APP to a domain that has a valid SSL cert.
    – Lix
    Dec 1, 2011 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.