19

I have faced this situation several times. Some websites are presented as a potential security risk. Should I continue to browse such a webpage?

I am attaching one example, just an example. Actually I need a general answer.

I was trying to find out the specs of some equipment made by Gilardoni, an Italian company. I followed the link from Google, but the browser somehow thinks the website is a potential security risk. I investigated further and found that the webpage is presenting a security certificate that has expired just yesterday. The company is famous in this field, but how do I know that I am not being a victim of an MITM attack or there isn't something phishy going on?

enter image description here

enter image description here

4
  • 13
    If you're seeing this a lot, it might be worth checking that the clock on your computer is right: maybe it thinks certificates have expired when they haven't. Dec 30, 2021 at 18:21
  • I get this every once in a while from firefox. What has always helped was using a different browser such as chromium, or simply closing and reopening firefox -> no more warning. So try that first. If the warning persists, try with your phone over mobile internet connection or even use your phone's internet with your computer.
    – user272170
    Dec 31, 2021 at 4:14
  • 1
    Apparently, they finally managed to repair the issue after a day and a half on "Fri, 31 Dec 2021 10:01:44 GMT" -- but instead of a one-to-one renewal they chose to abandon the non-www hostname. Seeing that they did the latter probably already on Nov 19 (date of latest DNS change), this was probably also the reason why automatic renewal failed in the first place: gilardoni.it could not be verified because it no longer existed. It's a pity though that they apparently did not monitor error messages from the automated process and thus did not learn about the problem until it hit. Dec 31, 2021 at 12:04
  • 1
    In any event. if your browser makes /any/ suggestion that a site's dodgy you probably don't want to give it any personal details, make payment to it and so on. Jan 1 at 21:18

3 Answers 3

35

As a practical matter, in this particular case you're probably fine. Certificates have expiration dates for a number of reasons, one of which is that there's always some risk of compromise (leaking the private key, somebody factoring the public key, etc.), and regularly rotating them mitigates this. Sites that use manually rotated certificates typically use lifetimes of at least a few months to a year (historically often a few years, but most browsers don't allow that anymore). Let's Encrypt is designed for automatic certificate rotation, so the validity is set relatively short because to the server, rotating every month, or even every day, shouldn't be very hard. In this case, it looks like the server has failed to rotate its cert on schedule, which is a sign of some kind of problem (likely just some sysadmin screwed something up, or some automated maintenance tool got broken), but it's probably not going to put your data at risk.

In general, though, be wary. If the certificate is invalid for any reason other than expiration, that's a very bad sign. If it expired long ago, that's a bad sign. If it's a really high-sensitivity site (e.g. banking, legal, or government site where you're submitting very valuable data), that's a bad sign. If you aren't confident whether or not you can tell the difference between "certificate is valid except it just expired" and "certificate is invalid because it's from a MitM, but also just expired to make me think it was valid yesterday" then follow the recommendation of your browser and don't trust the site.

Of course "don't trust the site" means different things depending on what you're doing with it. Don't enter credentials, or personally identifiable information, or other secrets. (That includes, don't visit the site if you logged in before and the site remembers your identity! That's done by the browser storing and automatically transmitting a secret.) Don't download software. Don't allow any requests for access to stuff like your microphone, camera, or location. But if you're just looking up an owner's manual, or checking a restaurant menu, or checking some public record, it's probably OK. In any case, though, if you aren't sure, it's pretty much always safest to just... not. It might take a few days considering the holidays, but if there's nothing actually wrong, it'll be fixed soon.

11
  • 2
    I don't want to ask a separate question, but there is a scenario I've run a few times which I'm unsure about: a subdomain website providing a cert for the base domain (say, foo.example.com presenting certificate for example.com). Gut feeling says it's fine for low-risk tasks, but eh.
    – jaskij
    Dec 30, 2021 at 17:48
  • 3
    @JanDorniak this is worth a separate question, but the reason usually is a honest misconfiguration. PKI and X.509 certificates are surprizingly hard matter for the average website admin. There are also "wildcard" certificates (like *.domain.tld) and multi-domain-name certificates (www.domain.tld + pop3.domain.tld + payment.domain.tld + somethingelse.domain.tld) that even more people get wrong.
    – fraxinus
    Dec 30, 2021 at 20:43
  • 5
    "... lifetimes of ... a few years ..." - Most browsers now refuse certificates that have a validity of more than 398 days, so certificates that last "a few years" shouldn't exist anymore.
    – marcelm
    Dec 30, 2021 at 22:18
  • 3
    @DetlevCM I'd say "is running on WordPress" may even be a bigger red flag than "LE cert expired yesterday" Dec 31, 2021 at 11:53
  • 2
    "don't visit the site if you logged in before and the site remembers your identity" -- or if your password manager will automatically fill a password field on the page. Even if the site doesn't usually have a password field on the page you're visiting, a MITM could include a hidden password field and a script to report the password as soon as it appears in the field. There could also be problems if you've previously granted camera/location/etc. permissions to the site. Jan 1 at 7:20
0

It probably is a glitch in the server - Lets Encrypt/certbot also sets up a cron job to make sure certificates are regularly auto-renewed in time.

On my Lets Encrypt setup, the certificate is shared between e.g. 'host.entity.com' and 'www.entity.com', and 'something.entity.com'.

All that is required in my server is that a Lets Encrypt server can make a successful connection to each of the URLs listed on the certificate, then the certificate will be issued.

So if for some reason one of my "servers" (all same IP address, different DNS records) go down , I assume that means the certificate stops renewing.

1
  • In the case at hand, they apparently decided several weeks ago to transition from serving both "www.domain.example" and "domain.example" to only "www.domain.example". As the old cert was about both hostnames, the automated renewal failed when it could no longer reach "domain.example". Perhaps they did not monitor renewal successes at all, or the one person receiving such messages enjoyed their well-deserved Christmas vacation ... Dec 31, 2021 at 12:24
0

How do you determine there isn’t a man in the middle attack going on? You don’t. It’s an expired certificate, so odds are you aren’t, on the other hand odds are almost always that you aren’t in the middle of a man in the middle attack even without SSL and a certificate.

If you want to trust odds, you never have to worry about an invalid certificate, regardless of why it is invalid.

Of course, they say the odds always catch up with you eventually…

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.