I\'ve made a payment to an online store and they\'re claiming there\'s no order

Question

I've made a payment to an online store and they're claiming there's no order with the number that appeared in my screen, therefore they're refusing to send me the product. I still have the page opened and I would like to save the entire content of the page in a way that the certificate goes together, so I can prove all that content was generated by them, so I can prove that order number were given to me.

How to do it? I've saved the HTML page already, and the certificate too, but I don't think it'll work. Can I do it in firefox? (the page is already open there).

Explanation / Answer

Saving the certificate won't help you.

When the HTTPS connection that delivered the HTML page was opened, your browser and their server securely established a (random) session key to use for the rest of the TLS session. Before proceeding with the HTTP request, your browser also verified that it was indeed talking to the owner of the certificate that was presented (that is, the holder of the corresponding private key).

When the HTTPS connection was closed, that session key was discarded (by both ends), so even if you had saved the ciphertext of the HTTPS interaction, neither party could decrypt it a second time. But anyway, neither of you saved the ciphertext unless you happened to be capturing packets at the time.

In short, your browser claims that the document displayed in its window is an untampered version of exactly what was delivered by the server but it is not in possession of what it takes to prove that.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.