1

Let's analyze the following situation:

  • A server is hosting 10 websites: site1.com - site10.com.
  • Only one of these websites uses SSL -site1.com.
  • If you try to access site2 - site10 over https the browser displays a certificate mismatch alert, but if you ignore the error, it redirects to http.

I know why the certificate alert is being displayed, but I do not know how to treat it from a security point of view.

Should the issue causing the browser alert be treated as an improper configuration problem, a security problem or is there no problem at all?

Improve this question

2 Answers 2

Reset to default
5

When a security warning is displayed, the user should treat it as a full-scale security emergency and trigger damage containment and recovery procedures. It is well-known that users do not do that; instead, they click OK or Cancel (whichever is nearest to the current mouse pointer position).

In the situation you describe, the user is trying to contact an inexistent site: there is no such thing as an SSL-enabled site2.com. Because of a quirk of HTTPS, the server cannot return the correct answer (namely "connection refused") and instead initiates a SSL connection with the certificate for site1.com (hence the warning). Once the SSL handshake is done, the browser sends the actual URL (which contains site2.com), the server becomes aware of the problem, and courteously offers a redirection to the non-HTTPS site.

If the client browser is recent enough, it may use the Server Name Indication extension, giving an advanced indication of the server name that the browser tries to reach (i.e. site2.com), which would allow the server to abort the SSL layer early on, avoiding the security warning popup on the client (the server would still have to be configured to implement that behaviour, though).

Improve this answer
1
  • So if the server supports Server Name Indication, then the configuration should be regarded as acceptable, considering the available technical solutions.
    – Dinu
    Feb 1, 2013 at 7:34
0

The browser has no way of knowing whether something is an improper configuration problem or a security problem, so it treats them all equally -- as security problems.

However, this situation is very widespread and is largely inevitable for any ISP hosting multiple sites. As long as we use IPv4 and must put multiple hosts on the same IP address, this will remain a problem.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .