SSL-Security loophole?

[Mark A Bennett <mark.bennett@xxxxxxxx>]

Dear tenon,

I hope that I can be quite clear about my problem and that it is solvable.

I have a secure domain, it has a verisign cert etc and works well 
(fast!) and gives me an encrypted domain.

However I find myself in EXACTLY the same situation as before:

If you delete all CA's from your browser then log into the domain you 
are prompted to accept the unknown cert. If you do all is well.

However..and this concerns me (and should you all), if you refuse the 
cert..you are then able to view the site NON-ENCRYPTED. What appears 
secure is in fact not. If you never fail mode test this you would 
never know.

OK, how do I force the server to REFUSE the connection if not 
secure-other servers do this as I have tried the above with them.

I know that there are apache directives to do this, how do I implement them?

Regards

Mark.

----
Tenon Intersystems' WebTen Mailing List
To unsubscribe: send mail to webten-request@xxxxxxxxx with the 
subject: unsubscribe
Find searchable Mailing List archives at
http://listsearch.blueworld.com/webtensearch.lasso