Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

When I try to visit some websites with HTTPS , I get the error that the SSL is self-signed and that the SSL is only valid for another domain, and that SSL is actually invalid.

If the SSL is valid only for other domains(Error code: ssl_error_bad_cert_domain) what should I do?
Stay to Http or go Https. Also can you explain my what is actually happening when I get that error.


Also when a certificate is only self-singed (Error code: sec_error_untrusted_issuer), I prefer HTTPS over HTTP, is what am I doing better?

share|improve this question

2 Answers 2

The SSL server certificate is meant to convey the public key of the server. This is the method by which you can know that you are talking to the right server, not a fake one setup by some attacker intent on grabbing your password or credit card details. If you browser warns you about the certificate, then this guarantee has evaporated (like dew in the morning Sun, as the usual metaphor goes).

The sane reaction when faced with a certificate-based warning from the browser is to stop accessing the site altogether. Proceeding with HTTP or HTTPS on that site is at your own risks.

If you MUST really browse that site, then just consider it as unreliable and unprotected. You don't really know if you are using the genuine server, or a fake one. Don't send any sensitive information to that server. Don't consider that any information sent by that server is true.

(In that situation, HTTPS is still "better" than HTTP in the following sense: if the error is due not to an actual attack, but a thorough misconfiguration, then HTTPS will still do some SSL which will offer some protection against passive attackers, who spy on the line but don't try to interfere with data exchanges. This is not a big protection, because passive-only attackers are rare.)

share|improve this answer

Self-signed certificate means that it is not issued by trusted Certificate Authority. Imagine your credit card being issued by yourself, not by your bank. Would sales assistant trust it?

In this case the webserver owner has to reconfigure. And you as a user can decide whether to trust this website and go on HTTP or leave.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.