Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?

share|improve this question
add comment

3 Answers

up vote 5 down vote accepted

Yes , the encryption still works fine .

It is the trust validation of the certificate that is failing.

Try capturing a wireshark dump and check the requests and see for yourself.

share|improve this answer
add comment

If there is no certificate, there is also no SSL and no encryption. It is not possible to set up a web site for SSL without a certificate.

If a browser doesn't trust a certificate (and there are many reasons why this could be the case) the encryption itself still works.

share|improve this answer
1  
+1 for adressing the no certificate case !! –  Arun Dec 16 '13 at 11:34
2  
Well, that's not entirely accurate. In SSL/TLS, certificates address the issue of trust and they have nothing to do with encryption. You can setup SSL/TLS with pre-shared secrets. RFC4279 already proposses three different algorithms to acomplish just that. –  Adnan Dec 16 '13 at 12:45
    
@Adnan - Interesting, I didn't know that. Are there any real-world web-servers that support this? If it is practical to have a pre-shared secret on all clients, wouldn't it be much easier to have your own CA and certificates instead? –  Peter Hahndorf Dec 16 '13 at 12:56
1  
@PeterHahndorf This isn't a proposed replacement for the PKI we already have, it's just that it's an option that is out there. An option that you completely disregarded and I tried to correct that little part. I don't know of any public web servers that uses SSL with pre-shared secrets. However, I have set up a couple of intranet servers where we used Diffie-Hellman with pre-shared secret. –  Adnan Dec 16 '13 at 13:11
    
@Adnan You're taking the context or "spirit" of the OP's question out of context for the sake of being "right". The OP's question was clearly in regards to certificates. The method you are describing is not practical for a publicly facing webserver in which anonymous/random users would need access. To my knowledge, IIS does not support RFC4279. –  k1DBLITZ Dec 18 '13 at 21:17
add comment

There is still encryption but its susceptible to MiTM attacks. An MiTM attacker can replace your certificate with his own, thus effectively rendering any encryption used useless.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.