What are the usecases for which browser users would thoroughly inspect the site's SSL certificate?

Question

When a site is opened via https:// in Firefox and Chrome browsers the address bar shows the well-known "lock sign" meaning that the connection is encrypted and "just relax, it's secure".

If the user clicks onto the lock sign he's shown a popup with details such as who runs the website and who issued the certificate. Next there's a "more information button" in Firefox that bring up a yet another panel. On the other panel there's a "view certificate information" button. In Chrome there's a link to "certificate information" on the first popup.

So there's a chain of elements that eventually leads the user to something like this (this is from Firefox):

If you wonder why I'm providing all the details - look at the expiration date and decide whether it's Sep 02 or Feb 09. So I suspect there's something wrong with this UI but I can't decide how this can be improved before I know why this panel exists in the first place.

What's the use of this panel? When would users want to see it and what will they be looking for in there and why?

Answer 1

The specific use of this panel is to view the contents of the SSL certificate; issuer, expiration date, validation type, protected subdomains, etc.

As an employee of a Certificate Authority (CA) (www.globalsign.com) I can tell you that end users interact with these certificate information panels all the time. There's a link in to our legal documentation in there, and we get thousands of monthly referrals from that link. Just what exactly the average web user is doing in there, I have no idea, perhaps just being curious.

What's it really for?

It's of most use to the site owner / technical web staff. Once you've installed a certificate and intermediate certificates on a server, you need to check that everything's working in the browsers. So you open them up and check this panel. Can't you just look for the padlock? Well, yeah, but if you've just renewed a certificate, you need to make sure you're seeing the new one in the browser. If you want make sure that a subdomain e.g. blog.yourdomain.com is already protected by one of your issued certificates, you would check in this panel.

So in this context, there's nothing really wrong with the UI, as you suspect. For the technical users who interact with the content, it does the job perfectly. Could it be more visually appealing/better laid out? Perhaps, but if I've learned anything from developing personas around these highly technical users, it's that provided the functionality is there, the "look" just isn't that important. In any case, improving this probably doesn't rank high in the browser developers' priorities.

There is also an edge use case where an end user, a security conscious shopper, would click to investigate that the certificate issuer is a known CA, and that the cert details match the domain they think they're on, but I imagine this is rare.