Whenever I buy something online or I receive bills on my mailbox with a link to pay via dotpay I always check if the page I am redirected to has a certificate valid for at least 1 year. Is it a good practice to do that or is it completely unnecessary? My reasoning is that if someone creates a scam website imitating my bank's website or dotpay website then they will probably have a certificate issued a couple of days ago and lasting only a month or so, because they know that page will be closed as soon as someone finds out it is a scam. Is this absurd or can it actually be used as a very quick way of partially validating if website is trusted?

  • 2
    Many sites (including Google) use only short-lived certificates today. – Steffen Ullrich Nov 16 '18 at 8:55

No, it's not a proper way to check. Long-lived certificates are largely falling out of favor because of the security implications, and are actually arguably less trustworthy than short-lived one. The reasoning behind this is as follows:

Suppose you own a website and purchase a TLS certificate for it with a validity of 10 years. Now assume that the key gets compromised on day one, and you never find out about this. Whoever got a hold of the key for that certificate can now impersonate your website for the next 10 years. If instead you had one that was valid for only 3 months, the amount of damage that attacker could do would be significantly less.

As far as actually checking whether a certificate is legitimate or not, there's not really anything you as a user can do.

  • Validity periods are out, because that's local policy. Some people still want to pay through their nose for long-validity certificates, so you will still see such certificates in regular usage, especially among companies that have been using SSL/TLS for the longest (banks for example).
  • Issuance date is out too, for the same reason that validity periods are no good. You might consider one right near the end of it's validity period to be questionable, but that's hardly going to be reliable.
  • Domain validation is out, as it's not hard for attackers to spoof the required DNS records (DNS is still one of the most insecure parts of the internet).
  • Extended validation is out, as it's largely a joke as most companies that provide it do it, and some popular companies just don't do it at all (largely because there really is near zero value to it for securing communications).

All the other checks you might do that look at the certificate itself are already done by your browser automatically (checking that the certificate is valid and hasn't been revoked, that the domai matches, and that the server has the associated key).

That said, you should be actively looking out for typosquatting, which may be a bit more obvious if you are looking at the certificate itself. A better defense for this though is to make sure that your browser displays non-ascii characters in domain names in their escaped or punycode form.

  • Thanks, I already look at page's url whenever I get redirected. I guess there isn't much else I can do except look for obvious visual mismatches compared to the real site. – FCin Nov 17 '18 at 2:54

This is not a proper way to check it. You will get a LOT of false positives. Just imagine all the Let`s encrypt certificates. These are all valid for just 3 months. And the purpose of the Let's encrypt project was to encourage certificates with a small lifetime and automated certification renewing.

It is not common, that banks uses these kind of certificates, but there are way better ways to check if a certificate is valid, i.e. CRL, OCSP, Certificate Transparency

  • Is it common for banks and online payment services to use certificates with short lifetime? From my experience they always have certificates issued for 1 or 2 years. – FCin Nov 16 '18 at 8:46
  • I edited my answer – Lithilion Nov 16 '18 at 8:53
  • "...there are way better ways to check if a certificate is valid..." - this question is not about validity of certificates but about using some heuristic to detect from a valid certificate if the site might be malicious (recently issued, short lifetime) or not (long lifetime). – Steffen Ullrich Nov 16 '18 at 10:17

I agree with the other responders - this is not a valid check. It can't hurt certainly, but it gives you little valid data for a variety of reasons.

What in particular are you looking to verify when you do this? There are better ways of getting that information. To check the validity of a vendor, for example, reviews may* be a better method. (Note that "may" is a keyword here, since reviews are obviously an extremely unreliable source of information.)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.