I'm relatively tech-savvy, but I'm no security expert. To my understanding, an invalid SSL certificate is only a problem if you're going to provide some sort of potentially exploitable information to a website and you are not sure that the website you're at is truly owned by the organization you believe it to be.

I ask because my workplace uses content filtering that makes every SSL cert invalid. The browser sees the website as originating from the content filtering server on the network rather than the actual server the website is being served from. I'm tempted to simply turn off certificate checking altogether in my browser (Firefox) because it's not doing anything for me other than creating hassle, but I wanted to check to see if there's some facet of the issue I might be missing? I'm smart enough to ensure that the website I'm visiting is the website I think I'm visiting without the confirmation of the cert, so based on my understanding, I shouldn't have any problems.

link|improve this question
5  
Even if the site you're visiting is the site you think you're visiting, I think that (but am not 100% sure) filtering could open you to man in the middle attacks by your employer. – AndrejaKo May 25 '11 at 18:12
@AndrejaKo - I suggest expanding upon your comment a bit, and posting it as an answer. It's a very good point. – Iszi Rory or Isznti May 25 '11 at 18:26
feedback

1 Answer

The main problem, IMHO, is that your browser (or your client's browser) is always complaining about invalid certificates. If it happens once in a while, you go and check whether is an error or not. If it happens every time you stop checking. I mean, your information could be safe from sniffing because you're encrypting the communication channel, but you may be talking with a rogue server, and that could be easily exploited.

link|improve this answer
feedback

Your Answer

 
or
required, but never shown

Not the answer you're looking for? Browse other questions tagged or ask your own question.