0

We use a third party service which if I put its URL in the browser , it display :

enter image description here

Looking at the certificate itself :

enter image description here

Questions:

1 - If I click "Proceed to x..." - Is the channel still using SSL to transfer the data ?

2- Am I safe to a middleman attack ?

3 - What other (if any) attacks am I exposed to ? ( except identity verification)

1 Answer 1

2

The reason

This certificate cannot be verified up to a trusted certification authority

means that the issuer of the certificate is not known to Chrome. It may be a legit certificate (eg. signed by the server owner itself, or by an organization for internal use), or it might be a malicious middleman.
It might help to ask Chrome for more details and post that here - another possibilty is a real CA that fell out of favor recently. There are some cases where browsver vendors stopped to ship a certificate of a certain CA because they messed up in some way (eg. giving out certificates without any check that the applicant is a real person and owns the server)

If I click "Proceed to x..." - Is the channel still using SSL to transfer the data

Yes - your connection to the other side is still encrypted. The problem is, what is "the other side". You have no guarantee by some publicly known CA that it is really the server you want.

Am I safe to a middleman attack ?

No.

What other (if any) attacks am I exposed to ? ( except identity verification)

As the server might not be the one you expect, everything you send there (or receive from there) might be not legit. It might be a "copy" of your bank site, and the attacker gets your code if you enter it. And so on...

2
  • Why am i not safe to mma? He can't read the data as he doesn't know the keys
    – Royi Namir
    Aug 22, 2017 at 7:09
  • @RoyiNamir Because it's possible that the certificate you got was made by the attacker (and then he knows the keys).
    – user155462
    Aug 22, 2017 at 7:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.