2

This question already has an answer here:

When I see the warning on my browser about "Invalid Certificate" or "Untrusted Certificate" , I might have doubt about a MITM attack at my network. Should I have the same concern when I see that the certificate expired warning? As I know, it happens only when the server did not renew its certificate, and it only shows that the server might use old security standards. Should I worry about anything other than this?

marked as duplicate by Xiong Chiamiov, Steffen Ullrich tls Nov 30 '17 at 5:29

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • I think my question is different, since I am asking specifically if I should be worry about a possible mitm attack or not. – Pilfility Nov 30 '17 at 16:16
6

If the certificate is expired (say, after two years), this means that a potential attacker had at least two years of time available to brute-force or otherwise attack the key. OK, this means more risk than when the cert is only a few months old, but with good keys there should still be virtually no sudden risk increase at the moment of expiry. Nevertheless, this aspect should not be discarded. (Also, old certs may have been produced in the good old days of less secure signatures)

But more importantly, when a key that is still active is compromised, this fact may be advertised by revocation (e.g., CRL or OSCP). If a key gets compromised after its expiry, this is not done (simply because it would be a waste of resources to track those cases when the certs are invalid anyway by expiry).

In fact, it may be the case that the owner did renew the certificate, but what you are looking at is a fake site created by a MITM.

So, yes, you should be sufficiently worried (and worried as hell if that is any site of importance such as a banking site or a shop) and maybe inform the owner.

-1

Mostly it is a trust issue.

If the client trusts invalid or expired certificates and he is used to it, what makes him distinguish between a valid expired / invalid certificate from other malicious one? Probably he will click without read yes to all questions...

Also if you are not following the rules / standard why to implement them? To keep the traffic safe? But why your customers should trust they are safe if you do not care with standards?

Not the answer you're looking for? Browse other questions tagged or ask your own question.