Is traffic not encrypted given ERR_CERT_COMMON_NAME_INVALID?

Question

If I am shown ERR_CERT_COMMON_NAME_INVALID, and I can see that the domains do not match (cert for *.example.com but I am visiting https://foobar.com), do I understand correctly that someone packet sniffing will still see encrypted traffic?

I'm trying to make sure I understand the threat of accepting these incorrect SSL certs. As I see it, it would be possible that a MITM is reading the traffic (decrypt it, then encrypt it correctly to pass it to the https site?) But unlike http it would still be encrypted traffic to someone "outside" - yes?

It's been a long sleepless night so forgive the stupidity.

Answer 1

You are correct. When you get a certification name invalid error, the piece of TLS that you lose is the authentication component; knowing that you're talking to the server you think you're talking to. The encryption component is not affected. So, as you suspect, you may not be (or may be, it could just be a configuration issue) talking to the correct server/site, but the encryption between you and whoever it is you are talking to is intact.