0

Shopping online today, I remembered to check if the website is https or not after I wrote my payment information in the checkout page. However, I find the https and when I tried to check who is the CA, is shows a blank rectangle area, and when I clicked on details, this is what I get.

enter image description here

When I hover over this 'x' on the right it says "Insecure(Broken)"

I tried the same thing, but from Safari, and nothing is wrong, I can view the certificate and it says connection is secure with no problem. I am not sure if this is browser flaw, or MITM ?

My main question is, How is this happening to be "https" when its broken ?

Would that be secure if I opened the VPN, with or without the web to be https ?

  • 2
    For me it's (1) unclear what you did ("a blank rectangle area" or "hover over this 'x' on the right"); (2) unclear what you ask about ("How is this happening to be "https" when its broken" or "Would that be secure if..."). The only thing that is clear is the screenshot and there's nothing strange with it. Maybe including more screenshots instead of descriptions would be better. – techraf Aug 27 '16 at 23:56
  • @techraf, this isn't chemistry...I bet you can get the point if you pay close attention rather than focusing on the "bad English" – user93097373 Aug 28 '16 at 5:48
6

The information in chrome clearly indicate why it is broken: not because the certificate is wrong but because of mixed content. It also shows you which site the non-https content would have been loaded from (see "Non-Secure Origins") and offers you to see more details.

I tried the same thing, but from Safari, and nothing is wrong,

Different browsers have sometimes different ideas of how dangerous specific types of mixed content are. For example some might accept if fonts are loaded insecurely while others require these to be loaded securely too. But the general trend is that everything has to be loaded securely.

I can view the certificate and it says connection is secure with no problem.

It's not a problem with the certificate but with the mixed content.

My main question is, How is this happening to be "https" when its broken ?

The protocol spoken to the main resource is still https.

Would that be secure if I opened the VPN, with or without the web to be https ?

A VPN only protects the connection to the VPN endpoint. Since the VPN endpoint is not the target server this would not solve this problem.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.