UWS has very powerful interactive SSL endpoint & certificate management functionality. This leads to a question often asked by web app developers: Is it be possible to register an SSL/HTTPS endpoint programmaticaly, when a redistributable web app gets registered with UWS during app installation?

The answer is, unfortunately, no, and the reason in the nutshell is that allowing it would violate sound security practices.

Here's the more nuanced explanation of why redistributable web app cannot have SSL out of the box. Most people can appreciate the importance of encryption of the wire traffic that SSL provides. However, most folks, including many software engineers, fail to realize that encryption is meaningless if one can't be sure who's on the other side of the wire. The assurance of the identity of the web server in SSL protocol comes from Certificate Authorities' practices that verify identity of the certificate holder. If a redistributable application was to register an SSL endpoind for itself, it would also have to provide certificate. Since redistributable application has no way of verifying server's identity, it would have to either create a self-signed certificate, or install same (possibly publicly-trusted) certificate on every box where it's installed. In both case server identity cannot be verified by the application when certificate is installed, meaning that clients would have encryption without server identity assurance, and this is a bad practice we cannot facilitate.

We do, however, allow end users to use these bad practices themselves, explicitly, via UWS cert management UI. When they do it, they do it at their own risk and it's their responsibility. However, an application installer doing it automatically may lead end users (who don't normally know what makes SSL secure) think that application is SSL-secure, when in fact it isn't. This is a legal liability for web application vendors, and it's also something that could make anti-virus makes black-list our web server as malware.

The bottom line is that if you realize that encryption is moot without server identity assurance, you will realize that apps lacking means to verify target system's server identity cannot possibly be secure even with SSL, and therefore should not be presented as such.

As a work-around, we have created a detailed walk-through of how to get publicly-trusted server certificate. If you are an application developer, please feel free to refer your customers who require SSL to this page.

Best regards,
UltiDev Team.

Message was deleted by a Moderator.