1. Alice navigates to https://example.com.
  2. https://example.com delivers an invalid certificate.
  3. https://example.com 302 redirects to https://www.example.com
  4. https://www.example.com delivers a valid certificate.

Question: will Alice see a warning on step 3

  • This is a common problem that can occur if a site is hosted entirely in SSL. Buying an SSL certificate with a SAN (subject alternative name) will get around this problem. Entrust offers one SAN "free" with each of their certificates. Not sure about the other vendors. – k1DBLITZ Nov 27 '14 at 2:01

Alice will see a warning. This is because the certificate is checked at the point where the SSL negotiation happens, which is before you get the contents of the page - whether those contents are an HTML page or a status code with a redirect.

For an example of why this is important, imagine this scenario:

Evul manages (e.g. by DNS cache poisoning or some other technique) to get you to go to his server instead of the real https://example.com. Evul does not have a correct cert for https://example.com, but he wants to redirect you to a page for which he does have a valid certificate, for instance his very own site https://www.evulkrakker.com, knowing that once you're redirected there you'll see that it has a valid certificate.

If there were no warning at the first site, you'd never know that you were redirected to his evil site.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.