1

I have setup a Tor Hidden Service, and have the .onion domain. I wish to setup HTTPS.

As I am using a self signed cert when a user visits my site they get a warning, which is extremely off putting.

I have seen many Tor sites using HTTPS which do not get any warnings.

  • Where can I get a certificate which allows .onion addresses? I tried using free Letsencrypt but they do not allow .onion domains yet.

I know HTTPS is not really necessary due to the amount of security already used on Tor, however I do like the extra protection.

Thank you!

  • 2
    blog.digicert.com/anonymous-facebook-via-tor might be relevant to your interests. – cacahuatl Jun 4 '16 at 15:12
  • That's a huge company paying thousands. I don't see how regular darknet marets etc... manage to get them?! – hggj Jun 4 '16 at 15:15
  • They probably don't. – cacahuatl Jun 4 '16 at 15:15
  • @canonizingironize They do. – hggj Jun 4 '16 at 15:17
  • Certs were discussed in a previous official Tor blog post: blog.torproject.org/blog/…. DigiCert currently seems the only way to go. Do you have a pointer to a regular .onion site that uses HTTPS? – Richard Horrocks Jun 4 '16 at 22:13
1

At the moment the only way to get a trusted SSL certificate for a .onion domain is to buy an EV (extended validation) certificate.

For more info see: https://www.digicert.com/blog/ordering-a-onion-certificate-from-digicert/

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.