-3

There is a website and I want to see if it is secure or not: When I enter the site with the domain address as

https://2nate.com/ the browser says that it is secure.

But when I enter the domain address as

https://www.2nate.com, my browser displays a warning that the site is not secure.

What is the problem and are these domains the same and are they secure or not?

  • @P.A.M I edited your question to change some wording to make it closer to what you seem to be trying to ask. Using the www subdomain results in a certificate error in your browser, and your browser tells you "not secure". – schroeder Jan 30 at 13:52
  • 2
    @VipulNair I didn't check, but an invalid certificate doesn't mean it's not encrypted. It's just not verifiable wether you're encrypting for the entity the certificate claims, i.e. not authenticated. – Tobi Nary Jan 30 at 14:33
6

They have a wrong record in the DNS.

The hostname 2nate.com has four IP addresses (2606:4700:30:0:0:0:681c:1163,2606:4700:30:0:0:0:681c:1063, 104.28.17.99 and 104.28.16.99). They all have a valid certificate that has an alternative name for *.2nate.com covering both hostnames, valid until 30 Jun 2019.

The hostname www.2nate.com has the same IPv6 records, but different record for IPv4: A 188.40.184.248. The certificate (and HTTPS connection) on that server is invalid in several ways. Changing the A record would make this hostname work perfectly fine with IPv4, too.

As a user you should only use the hostname that has a secure connection to the correct site. Their error on the other hostname doesn't affect that connection at all. It would be nice to give them a hint, though.

  • Instead of changing the A record so it points to the same resources it might be more maintainable to use a CNAME DNS record. – Enos D'Andrea Jan 30 at 14:32
  • ...and cause new problems as it not only replaces the A record, but all other resource types, too. – Esa Jokinen Jan 30 at 16:59
1

EDIT: this answer applies to an older version of the question, where the OP asked about the security of a site in general. Only later it was determined (and fixed in the question) that the OP only had problems to understand the security warnings it shows in the browser when accessing www.2nate.com with HTTPS compared to no such warnings when accessing 2nate.com with HTTPS.


There is a website and I want to see if it is secure or not ...

You are trying to access a website with HTTPS and with plain HTTP. In the first case the connection to the site is protected, i.e. the traffic is protected against sniffing and modification and you can be sure that the website is actually the one you can see as destination in the URL. When accessing the site with plain HTTP instead none of this is guaranteed, i.e. an attacker might intercept your connection to sniff and modify the traffic.

But, HTTPS vs HTTP only cares about protecting the communication between the client (browser) and the server. You cannot conclude that the website (or even broader the domain) is secure just because the connection to it is protected. The site might still be vulnerable to lots of attacks (XSS, SQL injection, CSRF ... just to name a few) or it might even be already taken over by an attacker when you visit it. And also can attackers have their own domains and can use proper HTTPS with these.

In other words: HTTPS allows secure access to a site while HTTP does not. But just because a site uses HTTPS does not mean that it is fully secure.

  • @P.A.M: HTTPS vs HTTP is not usable as an indicator of trust. You should not trust https://attacker/ even though the access is with HTTPS. Similar you should not trust https://good.domain.but.compromised or https://good.domain.but.full.of.bugs. – Steffen Ullrich Jan 30 at 13:42
  • "...why does ommiting the www makes it secure as https..." - I'm not sure what you are asking. But it might be that you are stumbling over the fact that 2nate.com has a valid certificate while www.2nate.com currently does not which results in a warning in the browser about an insecure site. This problem is likely due to a misconfiguration of the site. – Steffen Ullrich Jan 30 at 13:47
  • see my edits to the question. www.2nate.com returns a cert warning. The OP wants to know the impact of having a cert warning on the subdomain. – schroeder Jan 30 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.