Directory served over HTTPS

What this check verifies

The Web Bot Auth directory carries the public keys a verifier uses to check your signatures. This check looks at the resolved directory URL, after any redirects, and confirms it uses the https:// scheme. A http:// URL fails and caps the grade.

One thing to be precise about: the directory draft states the directory SHOULD be served over HTTPS, a strong recommendation rather than an absolute requirement. This checker is deliberately stricter than the letter of the spec here. Plaintext key distribution undermines everything the signatures prove, so the checker grades it as a critical failure. That is a policy decision of this tool, stated openly, in the same spirit as SSL Labs grading practices the TLS RFCs technically permit.

The check is on the scheme alone. It does not prove the body was served correctly; the reachability, media type, and JSON checks cover that. It only confirms the transport is encrypted.

Why it matters

The directory is the trust anchor for every signature you send. If a verifier fetches it over plaintext HTTP, anyone on the network path can rewrite the response in transit: swap your public keys for their own, then sign requests that verify against the keys they injected. The signature mechanism is then worthless, because the attacker controls the keys it is checked against.

HTTPS closes that gap. It authenticates the server and protects the response from tampering, so a verifier can trust that the keys it fetched are the keys you published.

A plaintext redirect is the same problem. If your HTTPS URL redirects through an http:// hop, the response is exposed on that hop, so the final scheme is what counts here.

How to fix it

1. Serve the directory over HTTPS with a valid certificate. The well-known path is https://<your-host>/.well-known/http-message-signatures-directory.
2. Reference the HTTPS URL everywhere your agent advertises it, including the Signature-Agent header it sends.
3. If you redirect from a bare or canonical host, keep every hop on HTTPS. Do not bounce through a plaintext URL.

The usual cause is an agent or configuration that still points at an http:// URL, or an HTTP-to-HTTPS redirect chain that passes through a plaintext intermediate. Confirm the final resolved URL starts with https://.

References

• RFC 7517 defines the JSON Web Key Set the directory serves.
• The web-bot-auth directory draft (draft-meunier-http-message-signatures-directory) recommends (SHOULD) serving the well-known endpoint over HTTPS.
• How grading works explains the grade cap this check imposes on failure.