Secure connections and Russian certificates

The icon by the address

The icon left of the address shows how the connection is protected:

• two sliders, no words: secure — HTTPS, and the certificate passed the check;
• Not secure: plain HTTP — what you send can be read and changed on the way; enter no passwords or card details;
• Not secure in red: you went past a certificate error, or the page ran insecure scripts.

Click the icon for the site's information: the connection, permissions, Cookies and site data and Site settings. The connection line leads to the details and to Certificate is valid.

The icon describes the connection, not the site: it does not check that a site is honest.

Russian certificates

Some Russian sites, Sberbank's for one, use certificates from the certificate authority of the Russian Ministry of Digital Development. Browsers without its root, Russian Trusted Root CA, show a certificate error on them.

Sverk has this root built in: such sites open without an error, with nothing to install in Windows. It works inside Sverk only.

The trust is limited: the authority can vouch only for sites under .ru, .su and .рф, and for sberbank.com, vtb.com, gazprombank.com and alfabank.com. For any other address, google.com say, Sverk refuses its certificate. The list is updated with the browser. If a Russian site outside it fails over such a certificate, write to us at support@sverk.ai.

If this certificate is already installed in Windows, Sverk, like other browsers, also trusts it through Windows — and then for any address.

Certificate errors

When a certificate fails the check, Sverk shows Your connection is not private with a code such as NET::ERR_CERT_AUTHORITY_INVALID instead of the site. Common causes:

• A wrong clock: Sverk shows Your clock is behind or Your clock is ahead; Update date and time opens the Windows settings.
• Wi-Fi with a sign-in page, as in a hotel: Sverk shows Connect to Wi-Fi; Connect opens the sign-in page.
• An antivirus or other program that inspects secure connections with its own certificates: if Windows does not trust them, every site fails. If Sverk knows the program, it says: An application is stopping Sverk from safely connecting to this site. Update the program or turn its inspection off.
• A router or network drive at an address like https://192.168.1.1 with a self-signed certificate.
• The site itself: an expired certificate, or one for another address.

To recognise a wrong clock or a sign-in page, Sverk contacts Google's servers on such an error (privacy policy).

The safe way out is Back to safety. To open the site anyway: Advanced → Proceed to … (unsafe). Sverk remembers this for a week; Turn on warnings in the connection details undoes it.

Do not go past the error where you enter passwords or card details, or when a familiar site suddenly shows it, especially on public Wi-Fi. Without a "Proceed to" link there is no way past it — say, when the site accepts secure connections only.

A guide to connection errors is built in: chrome://connection-help, which opens offline.

Always use secure connections

Sverk first tries an http:// address over HTTPS, and opens it as it is if that fails.

To be warned before sites without HTTPS, turn on Settings → Privacy and security → Security → Always use secure connections (off by default). Warns you for insecure public sites is selected at once; Warns you for insecure public & private sites adds home and work networks, a router's page among them.

The warning, This site doesn’t support a secure connection, offers Go back and Continue to site; once you continue, Sverk stops asking about the site for 15 days. In Incognito, and on sites you usually open over HTTPS, it warns even with the switch off.

Insecure content on a secure page

When an HTTPS page pulls something over plain HTTP, Sverk tries images, sound and video over HTTPS and drops them if that fails. HTTP scripts it does not run: they could change the whole page.

An icon on the right of the address bar tells of blocked scripts: Insecure content blocked. Load unsafe scripts allows them in this tab, for this site only — only if you trust the site.

Addresses that look like known ones

Fake sites use look-alike addresses: a letter from another alphabet, or a known name inside another address. Sverk compares the address with popular sites and those you visit often, and warns:

• with a page, Did you mean …?: Go to … opens the real site, Ignore the one you opened;
• or with a panel, Did you mean …?: Yes, continue opens the real site.

The check runs on the computer; its rules come with the security components (see the privacy policy).

Didn't find the answer?

Write to us at support@sverk.ai: what you did, what you expected to see and what you saw. Other topics are in the help contents.