Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Let's analyze the following situation:

  • A server is hosting 10 websites: -
  • Only one of these websites uses SSL
  • If you try to access site2 - site10 over https the browser displays a certificate mismatch alert, but if you ignore the error, it redirects to http.

I know why the certificate alert is being displayed, but I do not know how to treat it from a security point of view.

Should the issue causing the browser alert be treated as an improper configuration problem, a security problem or is there no problem at all?

share|improve this question
up vote 5 down vote accepted

When a security warning is displayed, the user should treat it as a full-scale security emergency and trigger damage containment and recovery procedures. It is well-known that users do not do that; instead, they click OK or Cancel (whichever is nearest to the current mouse pointer position).

In the situation you describe, the user is trying to contact an inexistent site: there is no such thing as an SSL-enabled Because of a quirk of HTTPS, the server cannot return the correct answer (namely "connection refused") and instead initiates a SSL connection with the certificate for (hence the warning). Once the SSL handshake is done, the browser sends the actual URL (which contains, the server becomes aware of the problem, and courteously offers a redirection to the non-HTTPS site.

If the client browser is recent enough, it may use the Server Name Indication extension, giving an advanced indication of the server name that the browser tries to reach (i.e., which would allow the server to abort the SSL layer early on, avoiding the security warning popup on the client (the server would still have to be configured to implement that behaviour, though).

share|improve this answer
So if the server supports Server Name Indication, then the configuration should be regarded as acceptable, considering the available technical solutions. – Dinu S Feb 1 '13 at 7:34

The browser has no way of knowing whether something is an improper configuration problem or a security problem, so it treats them all equally -- as security problems.

However, this situation is very widespread and is largely inevitable for any ISP hosting multiple sites. As long as we use IPv4 and must put multiple hosts on the same IP address, this will remain a problem.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.