1. An apparatus comprising: at least one computer memory that is not a transitory signal and that comprises instructions executable by at least one processor (58) to: receive, at a user device (300), a web application command to navigate to a target web site (302); receive a first server certificate of the target web site (302); present a user interface (UI) on the user device (300) prompting as to whether a representation of the server certificate should be recorded by the user device (300); responsive to a first input from the UI indicating the representation of the certificate should be recorded by the user device (300), record, by the user device (300), the representation of the first certificate; responsive to a second input from the UI indicating the representation of the certificate should not be recorded by the user device (300), not record, by the user device (300), the representation of the first certificate; subsequent to receiving the first input, receive, at the user device (300), the web application command to navigate to the target web site (302); receive a second certificate of the target web site (302); compare a representation of the second certificate to the representation of the first certificate recorded by the user device (300); responsive to the representation of the first certificate matching the representation of the second certificate, indicate or complete normal navigation to the target web site (302); responsive to the representation of the first certificate not matching the representation of the second certificate, perform additional processing steps to determine 24 the security nature of the change; and present an alert to the web application or UI on the user device (300) depending on the security nature of the change.

2. The apparatus as claimed in Claim 1, wherein the instructions are executable to: responsive to the first certificate not matching the second certificate, present on the user device (300) a selector to override the alert and complete normal navigation to the target web site (302).

3. The apparatus as claimed in Claim 1, wherein the instructions are executable to: responsive to the first certificate not matching the second certificate, present on the user device (300) a selector to report that the second certificate does not match the first certificate.

4. The apparatus as claimed in Claim 1, wherein the instructions are executable to: subsequent to receiving the second input, receive, at the user device (300), a browser navigation command to navigate to the target web site (302); receive the second certificate of the target web site (302); trust the second certificate and complete normal navigation to the target web site (302).

5. The apparatus as claimed in Claim 1, wherein the representation of the 25 certificate is one of the following: selected fields from the server certificate, the entire certificate, a hash of selected fields of the certificate, and a hash of the entire certificate.

6. The apparatus as claimed in Claim 5, comprising at least one display (50) controlled by the at least one processor (58) to present the UI.

7. An apparatus comprising: at least one computer memory that is not a transitory signal and that comprises instructions executable by at least one processor (58) to: receive, at a user device (300), a browser navigation command to navigate to a target web site (302); receive a certificate of the target web site (302); prior to completing the navigation command, send the certificate to a verification server (304); responsive to a first signal from the verification server (304) sent in response to the verification server testing the certificate, complete normal navigation to the target web site (302); and responsive to a second signal from the verification server (304) sent in response to the verification server testing the certificate, present an alert on the user device (300).

8. The apparatus as claimed in Claim 7, wherein the instructions are executable to: responsive to receiving the second signal, present on the user device (300) a selector to override the alert and complete normal navigation to the target web site (302). 26

9. The apparatus as claimed in Claim 1, wherein the instructions are executable to: responsive to the second signal, perform additional processing steps to determine a security nature of a certificate change.

10. The apparatus as claimed in Claim 7, wherein the instructions are executable to: responsive to receiving the second signal, present on the user device (300) a selector to report that the certificate is suspect.

11. The apparatus as claimed in Claim 7, comprising the at least one processor.

12. The apparatus as claimed in Claim 7, comprising at least one display (50) controlled by the at least one processor (58) to present the UI.

13. The apparatus as claimed in Claim 7, wherein a network address of the verification server (304) is hard-coded into a browser of the user device (300) from which the navigation command is received.

14. A method comprising: at a verification server (304), receiving from a user device (300) a target certificate of a target web site (302) not hosted by the verification server (304); at the verification server (304), comparing the target certificate to a previously stored certificate of the target web site (302); 27 responsive to a determination that the target certificate matches the previously stored certificate, sending to the user device (300) a first signal indicating that the user device (300) may safely complete navigation to the target web site (302); and responsive to a determination that the target certificate does not match the previously stored certificate, sending to the user device (300) a second signal indicating that the user device (300) may not safely complete navigation to the target web site (302).

15. The method as claimed in Claim 14, comprising receiving at the verification server plural certificates from respective candidate target web sites and storing the plural certificates.

16. The method as claimed in Claim 15, comprising validating at the verification server (304) each certificate from the candidate target web site (302) prior to storing the certificate by the verification server (304).

17. The method as claimed in Claim 14, wherein the target certificate is received from the user device (300) addressing the target certificate to a network address of the verification server (304) hard coded into a browser of the user device (300).

TRUSTING INTERMEDIATE CERTIFICATE AUTHORITIES
I. TECHNICAL FIELD
The application relates generally to trusting, or not, certificate authorities on the
Internet.
II. BACKGROUND
Popular Internet browsers such as Internet Explorer, Safari, Chrome, Opera, and
Mozilla (all of which should be considered to be trademarks) reference a number of
certificate authority (CA) and intermediate CA public key certificates in a local cache
resident on a client device. These CA or intermedia CA certificates are intended to be used
by Internet applications, such as a web browsers, to validate any server certificate that it
might encounter on the World Wide Web. Server certificates are received by client
devices such as PCs, tablets and smart phones when visiting certain websites that invoke
Transport Layer Security (TLS) which is associated with Hypertext Transfer Protocol
Secure (HTTPS). As of this writing, popular browsers typically have hundreds of CA
and Intermediate CA certificates in the local cache. The specific servers that the
certificates are each intended to authenticate are not known to the browser.
As understood herein, a website may have a server certificate signed by the
certificate authority or by an intermediate certificate authority (one whose trust is
established by a certificate authority). A compromise of any of the referenced CA or
intermediate CA certificates could allow the fraudulent synthesis of any server certificate,
even one that did not originally use the particular CA or intermediate CA in the authentic
server certificate. A fraudulent server certificate can allow for the interception of a user’s
2
credentials used to access any website and eavesdropping on communication. If the keys
of a particular server certificate were compromised, then sensitive information for only
that website would be at risk. As of this writing, fraudulent use of any of the CA or
intermediate CA in the local cache, could allow compromise of all websites visited. If the
compromised keys of CA or intermediate CA certificate were used discreetly by a hacker,
e.g. on a user-by-user basis and intermittently, then the activity might escape detection for
a long time. It would currently be difficult for modern browsers to detect a server
certificate is fraudulent when it is authenticated by a compromised CA or intermediate CA
that is believed to be trusted by the web application.
SUMMARY
As further understood herein, the above drawback has emerged as important,
because recent revelations have revealed the surreptitious capability to intercept Internet
queries from client devices without the devices’ browsers alerting the user that something
was amiss has actually occurred. It is believed that this may be facilitated when the
interceptor gains control of a CA or intermediate CA whose public key certificate has been
pre-loaded in the browser’s certificate cache along with many others, and using that, acts
as a “man-in-the-middle” between a real website and a client device or redirects traffic to
an imposter website controlled by the interceptor. The compromised CA or intermediate
CA could sign a "fake" server certificate for the imposter website. As mentioned above,
browsers are not able to tell which website server certificates the CAs or intermediate CAs
are supposed to be authenticating. If they are loaded in the browser’s certificate cache,
then they are all "trusted". A hacker can compromise any of the CAs or intermediate CAs
and use that one to sign a server certificate for any website even though a different CA
would have signed the legitimate server certificate. When accessing the imposter website
3
using HTTPS, TLS is invoked in which the server certificate would be used. The client
device would invoke security using the imposter server certificate that is provided by the
server itself, the user would see "HTTPS" on the uniform resource listing (URL) link, the
browser would show a "green lock", and the user would think that he or she is "protected"
and that a secure communication session was established with the legitimate remote
website, and would not be aware of any problem.
Accordingly, present principles provide a modification to commercial browsers so
that they are more proactively engaged in detecting a security compromise. Present
principles allow commercial browsers to detect if a server certificate has been changed and
the CA has been switched. The user can interface with the browser, or other web
application, in order to have it "remember the website certificate". This could be done by
actively engaging the user when visiting a site, e.g. by clicking on a button on screen, or
be done by a browser setting to have the browser remember the certificate in the
background. A user might wish to do this for certain sensitive sites such as financial or
email accounts. Alternatively, every website that is made a favorite could be automatically
remembered thereby alleviating the user from having to do anything specific. When
revisiting the website, if the server certificate changed, then the web application, e.g. web
browser, or user can be alerted to a change in the certificate. To accomplish this, the
browser creates a local database of server certificates that is used to check targeted
websites. Any change in the server certificate from the last recorded server certificate for
that site alerts the user that something has transpired.. In many cases, the stored certificate
will have expired with all of the fields, even the public key, remaining the same including
the certificate authority. In such an instance, the cached and older certificate would be
replaced by the new certificate with an expiry date in the future. It should be noted that the
entire certificate for the website need not be recorded. Rather, a hash of selected fields or a
4
hash of the server’s entire certificate could be recorded instead. Any change in the fields
of the server certificate would result in a different hash being calculated. Comparing the
calculated hash of the newly received certificate with the stored hash would have the same
result as comparing the selected fields or entire certificate for any type of change. If there
is a change, the browser can determine whether or not it was an update due to expiration
which might cause the stored certificate to be replaced, and a different change which
might require other action, e.g. a change in CA or intermediate CA might require research
to see if it is legitimate. A change in the certificate authority would be considered a serious
change which requires more analysis.
In addition or alternatively, the CA for a verification website can be hard coded
into the web browser, and a client device can pass a presented server certificate to the
verification website, which verifies whether the CA listed in the certificate is the valid one
for a particular website.
Accordingly, in an embodiment, an apparatus has a computer memory that is not a
transitory signal and that includes instructions executable by a processor to receive, at a
user device, a web application command to navigate to a target web site. The instructions
are executable to receive a first certificate of the target web site, present a user interface
(UI) on the user device prompting as to whether the certificate (or hash of the certificate)
should be recorded by the user device, and responsive to first input from the UI indicating
the certificate (or hash of the certificate) should be recorded by the user device, record, by
the user device, the first certificate. In contrast, the instructions are executable to,
responsive to second input from the UI indicating the certificate should not be recorded by
the user device, not record, by the user device, the first certificate. As mentioned,
recording can be done automatically for websites if they are listed as a user favorite and
not recorded if the website is not a favorite. The instructions are executable such that
5
subsequent to receiving the first input, a browser navigation command is received to
navigate to the target web site. A second certificate of the target web site is received and
compared to the first certificate recorded by the user device. Responsive to the first
certificate (or hash) matching the second certificate (or hash), normal navigation to the
target web site is indicated; otherwise, an alert is presented on the user device.
In some implementations, the instructions are executable to, responsive to the first
certificate (or hash) not matching the second certificate (or hash), present on the user
device a selector to override the alert and complete normal navigation to the target web
site.
In example implementations, the instructions are executable to, responsive to the
first certificate (or hash) not matching the second certificate (or hash), present on the user
device a selector to report that the second certificate does not match the first certificate.
The instructions can optionally show on the user device the differences in the fields
between the certificates. For example, the instructions could that the CA or intermediate
CA changed between the certificates which would be problematic, or that the old
certificate expiration date had occurred with the new one issued with a new expiration date
which might be a normal occurrence in the management of server certificates.
In examples, the instructions are executable to, subsequent to receiving the second
input, receive, at the user device, a browser navigation command to navigate to the target
web site, receive a second certificate of the target web site, trust the second certificate and
complete normal navigation to the target web site.
In another aspect, an apparatus includes a computer memory that is not a transitory
signal and that includes instructions executable by a processor to receive, at a user device,
a browser navigation command to navigate to a target web site. A certificate of the target
web site is received, and prior to completing the navigation command, the certificate is
6
sent to a verification server. Responsive to a first signal from the verification server sent in
response to the verification server testing the certificate, normal navigation to the target
web site may be indicated. However, responsive to a second signal from the verification
server sent in response to the verification server testing the certificate, an alert may be
presented on the user device.
Note that this second aspect may be combined with the first such that both tests
(local database comparison, and verification server validation) must pass to permit or
enable or otherwise indicate normal navigation to the web site.
In another aspect, a method includes, at a verification server, receiving from a user
device a target certificate of a target web site not hosted by the verification server. At the
verification server, the target certificate is compared to a previously stored certificate of
the target web site, and responsive to a determination that the target certificate matches the
previously stored certificate, a first signal is send to the user device indicating that the user
device may safely complete navigation to the target web site. On the other hand,
responsive to a determination that the target certificate does not match the previously
stored certificate, a second signal is sent to the user device indicating that the user device
may not safely complete navigation to the target web site.
The details of the present application, both as to its structure and operation, can
best be understood in reference to the accompanying drawings, in which like reference
numerals refer to like parts, and in which:
BRIEF DESCRIPTION OF THE DRAWINGS
Figure 1 is a block diagram of an example system including an example in
accordance with present principles;
7
Figure 2 is a block diagram of another system that can use the components of
Figure 1;
Figure 3 is a block diagram of an example specific system;
Figure 4 is a flow chart of example set up logic;
Figure 5 is a screen shot of an example user interface (UI) appertaining to Figure 4;
Figure 6 is a flow chart of a first example operational logic;
Figure 7 is a screen shot of an example UI appertaining to Figure 5;
Figure 8 is a flow chart of a second example operational logic; and
Figure 9 is a flow chart of example server logic to be used in cooperation with the
logic of Figure 8.
DETAILED DESCRIPTION
This disclosure relates generally to computer ecosystems including aspects of
consumer electronics (CE) device networks. A system herein may include server and
client components, connected over a network such that data may be exchanged between
the client and server components. The client components may include one or more
computing devices including portable televisions (e.g. smart TVs, Internet-enabled TVs),
portable computers such as laptops and tablet computers, and other mobile devices
including smart phones and additional examples discussed below. These client devices
may operate with a variety of operating environments. For example, some of the client
computers may employ, as examples, operating systems from Microsoft, or a Unix
operating system, or operating systems produced by Apple Computer or Google. These
operating environments may be used to execute one or more browsing programs, such as a
browser made by Microsoft or Google or Mozilla or other browser program that can
access websites hosted by the Internet servers discussed below.
8
Servers and/or gateways may include one or more processors executing
instructions that configure the servers to receive and transmit data over a network such as
the Internet. Or, a client and server can be connected over a local intranet or a virtual
private network. A server or controller may be instantiated by a game console such as a
Sony Playstation (trademarked), a personal computer, etc.
Information may be exchanged over a network between the clients and servers.
To this end and for security, servers and/or clients can include firewalls, load balancers,
temporary storages, and proxies, and other network infrastructure for reliability and
security. One or more servers may form an apparatus that implement methods of
providing a secure community such as an online social website to network members.
As used herein, instructions refer to computer-implemented steps for processing
information in the system. Instructions can be implemented in software, firmware or
hardware and include any type of programmed step undertaken by components of the
system.
A processor may be any conventional general purpose single- or multi-chip
processor that can execute logic by means of various lines such as address lines, data lines,
and control lines and registers and shift registers.
Software modules described by way of the flow charts and user interfaces herein
can include various sub-routines, procedures, etc. Without limiting the disclosure, logic
stated to be executed by a particular module can be redistributed to other software
modules and/or combined together in a single module and/ or made available in a
shareable library.
Present principles described herein can be implemented as hardware, software,
firmware, or combinations thereof; hence, illustrative components, blocks, modules,
circuits, and steps are set forth in terms of their functionality.
9
Further to what has been alluded to above, logical blocks, modules, and circuits
described below can be implemented or performed with a general purpose processor, a
digital signal processor (DSP), a field programmable gate array (FPGA) or other
programmable logic device such as an application specific integrated circuit (ASIC),
discrete gate or transistor logic, discrete hardware components, or any combination thereof
designed to perform the functions described herein. A processor can be implemented by
a controller or state machine or a combination of computing devices.
The functions and methods described below, when implemented in software, can
be written in an appropriate language such as but not limited to C# or C++, and can be
stored on or transmitted through a computer-readable storage medium such as a random
access memory (RAM), read-only memory (ROM), electrically erasable programmable
read-only memory (EEPROM), compact disk read-only memory (CD-ROM) or other
optical disk storage such as digital versatile disc (DVD), magnetic disk storage or other
magnetic storage devices including removable thumb drives, etc. A connection may
establish a computer-readable medium. Such connections can include, as examples,
hard-wired cables including fiber optics and coaxial wires and digital subscriber line
(DSL) and twisted pair wires. Such connections may include wireless communication
connections including infrared and radio.
Components included in one embodiment can be used in other embodiments in any
appropriate combination. For example, any of the various components described herein
and/or depicted in the Figures may be combined, interchanged or excluded from other
embodiments.
"A system having at least one of A, B, and C" (likewise "a system having at least
one of A, B, or C" and "a system having at least one of A, B, C") includes systems that
have A alone, B alone, C alone, A and B together, A and C together, B and C together,
10
and/or A, B, and C together, etc.
Now specifically referring to Figure 1, an example ecosystem 10 is shown, which
may include one or more of the example devices mentioned above and described further
below in accordance with present principles. The first of the example devices included in
the system 10 is a consumer electronics (CE) device configured as an example primary
display device, and in the embodiment shown is an audio video display device (AVDD) 12
such as but not limited to an Internet-enabled TV with a TV tuner (equivalently, set top
box controlling a TV). However, the AVDD 12 alternatively may be an appliance or
household item, e.g. computerized Internet enabled refrigerator, washer, or dryer. The
AVDD 12 alternatively may also be a computerized Internet enabled (“smart”) telephone,
a tablet computer, a notebook computer, a wearable computerized device such as e.g.
computerized Internet-enabled watch, a computerized Internet-enabled bracelet, other
computerized Internet-enabled devices, a computerized Internet-enabled music player,
computerized Internet-enabled head phones, a computerized Internet-enabled implantable
device such as an implantable skin device, etc. Regardless, it is to be understood that the
AVDD 12 is configured to undertake present principles (e.g. communicate with other CE
devices to undertake present principles, execute the logic described herein, and perform
any other functions and/or operations described herein).
Accordingly, to undertake such principles the AVDD 12 can be established by
some or all of the components shown in Figure 1. For example, the AVDD 12 can
include one or more displays 14 that may be implemented by a high definition or
ultra-high definition “4K” or higher flat screen and that may be touch-enabled for
receiving user input signals via touches on the display. The AVDD 12 may include one
or more speakers 16 for outputting audio in accordance with present principles, and at
least one additional input device 18 such as e.g. an audio receiver/microphone for e.g.
11
entering audible commands to the AVDD 12 to control the AVDD 12. The example
AVDD 12 may also include one or more network interfaces 20 for communication over at
least one network 22 such as the Internet, an WAN, an LAN, etc. under control of one or
more processors 24. Thus, the interface 20 may be, without limitation, a Wi-Fi transceiver,
which is an example of a wireless computer network interface, such as but not limited to a
mesh network transceiver. It is to be understood that the processor 24 controls the
AVDD 12 to undertake present principles, including the other elements of the AVDD 12
described herein such as e.g. controlling the display 14 to present images thereon and
receiving input therefrom. Furthermore, note the network interface 20 may be, e.g., a
wired or wireless modem or router, or other appropriate interface such as, e.g., a wireless
telephony transceiver, or Wi-Fi transceiver as mentioned above, etc.
In addition to the foregoing, the AVDD 12 may also include one or more input
ports 26 such as, e.g., a high definition multimedia interface (HDMI) port or a USB port to
physically connect (e.g. using a wired connection) to another CE device and/or a
headphone port to connect headphones to the AVDD 12 for presentation of audio from the
AVDD 12 to a user through the headphones. For example, the input port 26 may be
connected via wire or wirelessly to a cable or satellite source 26a of audio video content.
Thus, the source 26a may be, e.g., a separate or integrated set top box, or a satellite
receiver. Or, the source 26a may be a game console or disk player containing content
that might be regarded by a user as a favorite for channel assignation purposes described
further below.
The AVDD 12 may further include one or more computer memories 28 such as
disk-based or solid state storage that are not transitory signals, in some cases embodied in
the chassis of the AVDD as standalone devices or as a personal video recording device
(PVR) or video disk player either internal or external to the chassis of the AVDD for
12
playing back AV programs or as removable memory media. Also in some embodiments,
the AVDD 12 can include a position or location receiver such as but not limited to a
cellphone receiver, GPS receiver and/or altimeter 30 that is configured to e.g. receive
geographic position information from at least one satellite or cellphone tower and provide
the information to the processor 24 and/or determine an altitude at which the AVDD 12 is
disposed in conjunction with the processor 24. However, it is to be understood that that
another suitable position receiver other than a cellphone receiver, GPS receiver and/or
altimeter may be used in accordance with present principles to e.g. determine the location
of the AVDD 12 in e.g. all three dimensions.

We claim:
1. An apparatus comprising:
at least one computer memory that is not a transitory signal and that comprises
instructions executable by at least one processor (58) to:
receive, at a user device (300), a web application command to navigate to a target
web site (302);
receive a first server certificate of the target web site (302);
present a user interface (UI) on the user device (300) prompting as to whether a
representation of the server certificate should be recorded by the user device (300);
responsive to a first input from the UI indicating the representation of the certificate
should be recorded by the user device (300), record, by the user device (300), the
representation of the first certificate;
responsive to a second input from the UI indicating the representation of the
certificate should not be recorded by the user device (300), not record, by the user device
(300), the representation of the first certificate;
subsequent to receiving the first input, receive, at the user device (300), the web
application command to navigate to the target web site (302);
receive a second certificate of the target web site (302);
compare a representation of the second certificate to the representation of the first
certificate recorded by the user device (300);
responsive to the representation of the first certificate matching the representation of
the second certificate, indicate or complete normal navigation to the target web site (302);
responsive to the representation of the first certificate not matching the
representation of the second certificate, perform additional processing steps to determine
24
the security nature of the change; and
present an alert to the web application or UI on the user device (300) depending on
the security nature of the change.
2. The apparatus as claimed in Claim 1, wherein the instructions are executable
to:
responsive to the first certificate not matching the second certificate, present on the
user device (300) a selector to override the alert and complete normal navigation to the
target web site (302).
3. The apparatus as claimed in Claim 1, wherein the instructions are executable
to:
responsive to the first certificate not matching the second certificate, present on the
user device (300) a selector to report that the second certificate does not match the first
certificate.
4. The apparatus as claimed in Claim 1, wherein the instructions are executable
to:
subsequent to receiving the second input, receive, at the user device (300), a browser
navigation command to navigate to the target web site (302);
receive the second certificate of the target web site (302);
trust the second certificate and complete normal navigation to the target web site
(302).
5. The apparatus as claimed in Claim 1, wherein the representation of the
25
certificate is one of the following:
selected fields from the server certificate, the entire certificate, a hash of selected
fields of the certificate, and a hash of the entire certificate.
6. The apparatus as claimed in Claim 5, comprising at least one display (50)
controlled by the at least one processor (58) to present the UI.
7. An apparatus comprising:
at least one computer memory that is not a transitory signal and that comprises
instructions executable by at least one processor (58) to:
receive, at a user device (300), a browser navigation command to navigate to a target
web site (302);
receive a certificate of the target web site (302);
prior to completing the navigation command, send the certificate to a verification
server (304);
responsive to a first signal from the verification server (304) sent in response to the
verification server testing the certificate, complete normal navigation to the target web site
(302); and
responsive to a second signal from the verification server (304) sent in response to
the verification server testing the certificate, present an alert on the user device (300).
8. The apparatus as claimed in Claim 7, wherein the instructions are executable
to:
responsive to receiving the second signal, present on the user device (300) a selector
to override the alert and complete normal navigation to the target web site (302).
26
9. The apparatus as claimed in Claim 1, wherein the instructions are executable
to:
responsive to the second signal, perform additional processing steps to determine a
security nature of a certificate change.
10. The apparatus as claimed in Claim 7, wherein the instructions are executable
to:
responsive to receiving the second signal, present on the user device (300) a selector
to report that the certificate is suspect.
11. The apparatus as claimed in Claim 7, comprising the at least one processor.
12. The apparatus as claimed in Claim 7, comprising at least one display (50)
controlled by the at least one processor (58) to present the UI.
13. The apparatus as claimed in Claim 7, wherein a network address of the
verification server (304) is hard-coded into a browser of the user device (300) from which
the navigation command is received.
14. A method comprising:
at a verification server (304), receiving from a user device (300) a target certificate
of a target web site (302) not hosted by the verification server (304);
at the verification server (304), comparing the target certificate to a previously
stored certificate of the target web site (302);
27
responsive to a determination that the target certificate matches the previously stored
certificate, sending to the user device (300) a first signal indicating that the user device (300)
may safely complete navigation to the target web site (302); and
responsive to a determination that the target certificate does not match the
previously stored certificate, sending to the user device (300) a second signal indicating that
the user device (300) may not safely complete navigation to the target web site (302).
15. The method as claimed in Claim 14, comprising receiving at the verification
server plural certificates from respective candidate target web sites and storing the plural
certificates.
16. The method as claimed in Claim 15, comprising validating at the verification
server (304) each certificate from the candidate target web site (302) prior to storing the
certificate by the verification server (304).
17. The method as claimed in Claim 14, wherein the target certificate is received
from the user device (300) addressing the target certificate to a network address of the
verification server (304) hard coded into a browser of the user device (300).