HTTPS icon red and crossed out - Chrome browser

Question

What does it actually mean when the HTTPS icon is red and crossed out in Chrome?

Does this mean that the site is vulnerable to a Man in the Middle Attack? Is it safe or not?

Answer 1

When the https portion of the URL in Chrome has a red line through it, there is a problem with the security of the site you are going to. To see exactly what the problem is, you need to click on the padlock and see the detailed connection info.

Detailed connection info is documented here.

If you see , then you've established a secure connection with a trusted site, and do not need to worry about MITM attacks.

If you see , then the connection is unencrypted, and subject to MITM attacks.

If you see or , then either the connection is only partially encrypted or it's encrypted with a party that's not trusted (e.g., a self signed cert, name mismatch, or imposter). In these cases you may be subject to a MITM attack.

With these last two, the level of exposure varies. It might be that the remote site is properly encrypted, but just happens to have a few "IMG SRC=http://..." tags that cause mixed content. That "mixed content" can be sniffed on the network. Or, it might be that you've gone to an impostor site "gooogle.com" instead of "google.com", and everything you send is encrypted but going to a malicious attacker. Or anywhere in between. The rule of thumb is, essentially, unless you understand why it's red, you shouldn't trust it.

Answer 2

A crossed out https could mean that the certificate uses the dated "SHA-1" security which is not as secure as it was at its induction 20 years ago. Chrome is simply telling us that. IE and Firefox are not yet reporting sites that use "SHA-1" but will soon. To verify this is the problem, I suggest you open the website in one of the other browsers to see if they state a https connection. If not, then the websites certificate may be something other than the "SHA-1" issue.

Answer 3

You're referring to when web browsers draw a red line through the "https://" in their URL bars.

It means that the browser does not trust the certificate that the site is using, for many possible reasons:

• it isn't signed by one of the root CA certificates that the browser implicitly trusts
• it's signed by a root CA certificate that the browser used to trust, but doesn't any more because the CA turned out to a rogue
• the certificate has expired
• the certificate has been revoked by its creator
• the certificate says it is for another site, not the site you're looking at

...but nonetheless you asked that a security exception be made and you be allowed to see the site anyway.

You and your browser are vulnerable to a MitM attack, but remember that every site in the world that begins "http://" rather than "https://" is also vulnerable to a MitM attack, and there will be no warnings or red flags about it.

If you see the "https" scored out in your browser, then you have about the same level of security as a regular "http" website, so you should only use it if you're happy with no guarantee of privacy or authenticity.