Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

When I click on a link to an HTTPS link, the browser will sometimes ask for confirmation or channel me though a form before it will allow me to se the page. Why would it do this?

(This question started life as a slightly different question, but what I wrote originally was open to interpretation. I've rewritten the question to more clearly match the answers I have, and I'll re-ask my original question later at a later date. See When people give good answers to the wrong question )

share|improve this question
1  
It is a good question why did Internet Explorer developers choose to warn about entering a secure site... I think that has been removed now, though. –  grawity Nov 5 '11 at 1:10
    
Read the message. It should explain why the message was issued. –  David Schwartz Nov 5 '11 at 2:39
1  
Knowing more information about your phone would help. What is the manufacturer, and what is the browser and browser version? –  steampowered Nov 5 '11 at 10:05
1  
Its a Nokia E75, but I've seen many different browsers do this. –  billpg Nov 5 '11 at 10:12

2 Answers 2

up vote 6 down vote accepted

Trust for HTTPS is based on the certificates being signed by a trusted certificate authority. There are now hundreds of these, but your phone may exclude authorities you are less likely to encounter. There are several reasons why you can expect to be asked if you want to connect:

  • The certificate was issued for a domain other than the one you are connecting to. This may occur more frequently for phones as some organizations use different domains for phones (mobile devices) than the one used for their main site. You may also encounter this with phishing sites.
  • The certificate was signed by an authority which is not loaded in your phone's (or browser's) database of trusted authorities.
  • The certificate was signed by a trusted authority but has expired. Signatures are usually only good for one or two years.
  • The certificate was not signed by a trusted authority. These are often self-signed certificates, but may be signed by an untrusted authority. This is the form I use for my personal site. (HTTPS is only used for personal data.)

This is likely not a complete list of reasons you may be prompted to continue connecting. If information on the reason is available, consider it before continuing.

I suspect we will soon be able to add another item to this list:

  • The authority was trusted, but had their signing certificate compromises (stolen). At least two trusted authorities appear to fall in this class already.
share|improve this answer

Unless I am mistaken, you should be prompted to continue if there is any problem with the security certificate.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.