Blizzard's Battle.net Updater Installs Root Certificate
Looking at the certificate posted lower in this thread, everyone is throwing a fit over nothing.  <i>This is</i> the correct way to do what they want to do, unless they want to register&#x2F;use an application protocol.<p>They have a REST server running locally, and they want to link to it from websites on the internet.  So they created the domain localbattle.net which points to 127.0.0.1.  But there&#x27;s a problem, they can&#x27;t use http traffic (because of mixed content warnings, even though it wouldn&#x27;t really be insecure), so they have to use https traffic.  They can&#x27;t use a public CA because the CA would throw a fit if they found out keys for certs were being distributed in an application (they could lose trust in major browsers due to something like that).  So they generate a non-ca certificate (notice the cert doesn&#x27;t have basicConstraints: CA=true) during setup, install it in the OS so the browsers trust it, and use it in their local webserver.  The key is only available on the computer (and I assume it&#x27;s stored in a secure manner).  The only way they could use this cert to mitm your SSL traffic, or phish&#x2F;pharm you is to do that same process with a different domain in the subjaltname extension.<p>I think this is a clever and secure solution to the problem they face. 
At the end of the day you&#x27;re already running their code on your computer and have given it admin privileges in the past, so you can&#x27;t say you don&#x27;t trust the application, and this doesn&#x27;t introduce any supply-chain type vulnerabilities that could be exploited down the line (that didn&#x27;t already exist in the auto-updater, which is a much bigger issue I have with the Blizzard client).<p>So I guess I&#x27;m asking, what am I missing, why is everyone freaking out at Blizzard?