According to various sources (like this question) DuckDuckGo has an onion site. However,

  1. I can't easily find any mention of it on their clearnet site (but I stumbled across a special search result page) and
  2. the certificate used on the onion site is not valid for the .onion address, only for *.duckduckgo.com and duckduckgo.com.

Verifying that the .onion certificate is the same as the official one and not from some CA breach is not easy: it seems Firefox doesn't show certificate details in the Page Info when you get a certificate warning. I was finally able to compare them using this command (You can ignore the SSL session differences):

meld \
    <(openssl s_client -connect duckduckgo.com:443 -status <<< '') \
    <(torify openssl s_client -connect 3g2upl4pq6kufc4m.onion:443 -status <<< '') &

What am I supposed to do as an end user in this situation? Not use HTTPS? Ask DuckDuckGo to update their certificate & web site? Verify the certificate manually each time? Or have I misunderstood how .onion sites work?

(DuckDuckGo is just an example; I'm sure there are other .onion sites with the same issues.)

  • SSL is pretty useless when tor is already Point-To-Point encrypted, and you can verify the "certificate" with the address. Commented Mar 12, 2016 at 3:56
  • @php_coder_3809625 How do you mean? The host name "3g2upl4pq6kufc4m.onion" doesn't tell me anything about the owner, and it's trivial to set up a scraping site which just forwards traffic to the real site. So as far as I can tell nothing about the address verifies the owner.
    – l0b0
    Commented Mar 12, 2016 at 9:26
  • The address is a summary to the public key of that (client) hidden service node. Also hidden web is built for anonymity so SSL won't get you very far. Commented Mar 14, 2016 at 23:19

3 Answers 3


This is an open question. One suggestion is to actually create a new HTTP header like 'X-Onion-Address: foo.onion', which is only respected after a successful TLS connection is established.

Facebook's approach is to have the onion site's TLS be properly signed and also valid for facebook.com

        X509v3 Subject Alternative Name: 
            DNS:*.facebookcorewwwi.onion, DNS:facebookcorewwwi.onion, DNS:*.m.facebookcorewwwi.onion, DNS:*.fbcdn23dssr3jqnq.onion, DNS:*.xx.fbcdn23dssr3jqnq.onion, DNS:*.xy.fbcdn23dssr3jqnq.onion, DNS:*.xz.fbcdn23dssr3jqnq.onion, DNS:*.fbsbx2q4mvcl63pw.onion, DNS:www.facebook.com

The 'darkweb-everywhere' add-on team (imagine https-everywhere but for onions) also collected evidence of the validity of claims of onion ownership, although it's no longer up to date their collected evidence can be found here: https://github.com/chris-barry/darkweb-everywhere/blob/master/doc/EVIDENCE.md

edit: Also, Firefox/Tor Browser will allow you to view the vertificate. When you click on 'I Understand the Risks -> Add Exception' there is a 'View' button to let you view the certificate and once you've accepted it, you can click the padlock on the URL bar, go to 'More Information' then 'View Certificate' to get the same screen.


[waves] Facebook-over-Tor-geek here. It's a toughie, the cleanest thing is to use the same SSL certificate in your clearnet and onion sites, but this only will work if you can use EV certificates on both.

Facebook currently (March 2016) uses DV certificates for our main site - mostly because EV certificates don't currently support wildcards for clearnet address, only for onion addresses.

If the situation changes so that either ".onion" becomes okay for DV certs, or else EV becomes a suitable option for the main site, then maybe there will be a clearnet site which mentions the onion.

However: if you have an EV clearnet certificate for your main site, then I imagine you'd be able to add your onion address to it...

Alec Muffett
Facebook Engineering

  • +1, but "EV certificates don't currently support wildcards for clearnet address, only for onion addresses." I think you meant the other way around…?
    – l0b0
    Commented Mar 15, 2016 at 8:09
  • Incorrect. EV Certificates do not support wildcards, except in the case that the certificate has been issued for an Onion address. See cabforum.org/2015/02/18/… Commented Apr 10, 2016 at 9:27

Don't be hasty ;) First, FF itself is not about to do everything, and you must use add-ons for the exact functionality set you're looking for. The add-ons I'll mention downstrings are - IMHO - a must-have for clearnet too:

and if you're using a standalone/portable FireFox - make sure to use FoxyProxy add-on.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .