1

On my phone when I try and access my regular websites, I get the error message " there are problems with the security certificate of this website". More often than not I still proceed onto the website. If it is a website that I regularly go on, is it safe to proceed on to the site anyway?

  • 1
    If it really is your regular website, and especially if your (phone) client is wrong about the cert problem, it is perfectly safe. If it really is a MitM website run by thieves that looks and behaves exactly like your regular website, it is massively dangerous. How do you tell the difference? – dave_thompson_085 Sep 20 '15 at 8:19
1

Proceeding when the certificate doesn't validate roughly turns the secure HTTPS into the insecure HTTP. It is very bad to hit continue. If the same websites work safely from your desktop, it is probably a browser problem that you have to fix. That means fixing the problem is out of scope for this website. You need an Android support website. But maybe I can help you.

Try the following in order from first to last. Stop when the problem is fixed.

  1. Some Android phones/tablets are known to do this when the date/time is set incorrectly. Reset your date/time.

  2. Delete the cached data for the browser application.

  3. Delete the browser app if you can.

  4. Switch to a different browser app if you can.

  5. Factory reset your phone/tablet.

  6. Contact your phone/tablet support channel.

Good luck!

0

First you need to keep in mind what a certificate conveys. A valid certificate on an HTTPS site indicates that the site is genuine, not that it is safe. A site with a valid certificate can be bad for many reasons:

  • The site itself is genuine, but the owners put malicious content there (deliberately or accidentally).
  • The site itself is genuine and its content is fine, but it serves malicious content through ads.
  • The site itself is genuine, but a vulnerability allowed attackers to modify it to serve malicious content.
  • The site is genuine and doesn't serve malware, but serves data that's incorrect for whatever reason.

In addition to guaranteeing that the site is genuine, a valid certificate also guarantees that your connection with the site is secure:

  • The content you see is served by the legitimate site, and what the site receives from you is what you uploaded (URLs, form input, etc.).
  • Only you and the site know the content of the data that's exchanged. (However an eavesdropper can know what site you're connecting to, what volume of data you're exchanging, and can sometimes make additional guesses based on the traffic rate.)

So the question is, which of these properties are you after? A valid HTTPS certificate doesn't help with the safety properties, but if you know that the genuine site is safe, the valid certificate guarantees that the site you're connecting to is the genuine site, and thus safe (assuming it hasn't just been hacked).

If the certificate is invalid, this doesn't necessarily mean that the site you're connecting to is a fake one. It depends. There are a number of common intermittent false positives:

  • The certificate was valid, but has expired. This is almost always benign. Certificates expire because they can very occasionally become invalid (because ownership of the domain has changed, because of a rare cryptographic breakthrough); but mainly certificates expire because the companies that grant them want a steady income flow. An expired certificate doesn't become easier to crack overnight.
  • The certificate is valid, but uses a variation to the protocol that your browser doesn't support. Thus it can happen sometimes that a site displays correctly in one browser but not in another.
  • The certificate is valid, but for a variation of the site name (e.g. www.example.com vs. example.com). Try the other name.
  • The certificate is issued by a certification authority that is trusted by one browser, but not by a different one. That can happen for example for an intranet site that's signed by a company-internal CA, which is added to the trust list of the default system image for corporate computers but not on BYOD phones.

You can look at the details of the certificate to see the nature of the problem. But it is difficult to tell. It's easy enough to check the expiry date, for example — but unless you know that the certificate that the site serves now is the same that it served back before the expiry date, that doesn't help you much: many browsers don't make it easy to check that the expiry date was the only problem with the certificate.

In the end, an invalid HTTPS certificate is no worse than accessing the site over HTTP. If you would have been willing to access the site over HTTP, you don't lose anything by accessing it over HTTPS with an invalid certificate.

There is actually a benefit to HTTPS in the presence of a passive attacker — an adversary who can spy on the traffic but not modify it. A passive attacker cannot present a fake site or spy on the content even if the site doesn't have a valid certificate. However, if the site normally has a valid certificate, but you're now presented with an invalid certificate, that would tend to indicate that something is wrong, possibly (but, as we've seen, not necessarily) an attack.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.