6

When I click on a link to an HTTPS link, the browser will sometimes ask for confirmation or channel me though a form before it will allow me to se the page. Why would it do this?

(This question started life as a slightly different question, but what I wrote originally was open to interpretation. I've rewritten the question to more clearly match the answers I have, and I'll re-ask my original question later at a later date. See When people give good answers to the wrong question )

4
  • 1
    It is a good question why did Internet Explorer developers choose to warn about entering a secure site... I think that has been removed now, though. Nov 5, 2011 at 1:10
  • Read the message. It should explain why the message was issued. Nov 5, 2011 at 2:39
  • 1
    Knowing more information about your phone would help. What is the manufacturer, and what is the browser and browser version? Nov 5, 2011 at 10:05
  • 1
    Its a Nokia E75, but I've seen many different browsers do this.
    – billpg
    Nov 5, 2011 at 10:12

2 Answers 2

6

Trust for HTTPS is based on the certificates being signed by a trusted certificate authority. There are now hundreds of these, but your phone may exclude authorities you are less likely to encounter. There are several reasons why you can expect to be asked if you want to connect:

  • The certificate was issued for a domain other than the one you are connecting to. This may occur more frequently for phones as some organizations use different domains for phones (mobile devices) than the one used for their main site. You may also encounter this with phishing sites.
  • The certificate was signed by an authority which is not loaded in your phone's (or browser's) database of trusted authorities.
  • The certificate was signed by a trusted authority but has expired. Signatures are usually only good for one or two years.
  • The certificate was not signed by a trusted authority. These are often self-signed certificates, but may be signed by an untrusted authority. This is the form I use for my personal site. (HTTPS is only used for personal access.)

This is likely not a complete list of reasons you may be prompted to continue connecting. If information on the reason is available, consider it before continuing.

I suspect we will soon be able to add another item to this list:

  • The authority was trusted, but had their signing certificate compromised (stolen). At least two trusted authorities appear to fall in this class already.
0
3

Unless I am mistaken, you should be prompted to continue if there is any problem with the security certificate.

0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .