2

When I have a website run on https and there is no certificate, there is wrong certificate or out of date like here does encryption still work or not?

3 Answers 3

6

Yes , the encryption still works fine .

It is the trust validation of the certificate that is failing.

Try capturing a wireshark dump and check the requests and see for yourself.

12

If there is no certificate, there is also no SSL and no encryption. It is not possible to set up a web site for SSL without a certificate.

If a browser doesn't trust a certificate (and there are many reasons why this could be the case) the encryption itself still works.

5
  • 1
    +1 for adressing the no certificate case !!
    – Arun
    Dec 16, 2013 at 11:34
  • 2
    Well, that's not entirely accurate. In SSL/TLS, certificates address the issue of trust and they have nothing to do with encryption. You can setup SSL/TLS with pre-shared secrets. RFC4279 already proposses three different algorithms to acomplish just that.
    – Adi
    Dec 16, 2013 at 12:45
  • @Adnan - Interesting, I didn't know that. Are there any real-world web-servers that support this? If it is practical to have a pre-shared secret on all clients, wouldn't it be much easier to have your own CA and certificates instead? Dec 16, 2013 at 12:56
  • 1
    @PeterHahndorf This isn't a proposed replacement for the PKI we already have, it's just that it's an option that is out there. An option that you completely disregarded and I tried to correct that little part. I don't know of any public web servers that uses SSL with pre-shared secrets. However, I have set up a couple of intranet servers where we used Diffie-Hellman with pre-shared secret.
    – Adi
    Dec 16, 2013 at 13:11
  • @Adnan You're taking the context or "spirit" of the OP's question out of context for the sake of being "right". The OP's question was clearly in regards to certificates. The method you are describing is not practical for a publicly facing webserver in which anonymous/random users would need access. To my knowledge, IIS does not support RFC4279.
    – k1DBLITZ
    Dec 18, 2013 at 21:17
3

There is still encryption but its susceptible to MiTM attacks. An MiTM attacker can replace your certificate with his own, thus effectively rendering any encryption used useless.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .