Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 2 down vote favorite

As an example, click on https://www.sciencedaily.com/releases/2012/04/120430140033.htm

Normally, I use Chrome to force all of the sites I visit to go through https, so the links I click are also https links. I could remove the "s" in https but I hate added friction.

share|improve this question

4 Answers

up vote 5 down vote accepted

Open the certificate and you'll find out what the problem is:

enter image description here

The certificate was issued by an authority that is not (or no longer) trusted.

This means the authority could have been compromised and the server you're talking to isn't the one you think. Someone might have just created a duplicate of the certificate of the original server and signed it with the compromised CA key.

Encryption is only half the game. You also have to ensure that your encrypted data go to whomever you want!

Or it could just mean that whoever runs the server used a self-signed certificate to provide only encryption without any means of party verification.

share|improve this answer
X.509 does not use "web of trust", but a hierarchical "certificate authority" system. – grawity May 5 '12 at 16:22
1  
@grawity: I thought the root CAs established trust with each other. But I removed the statement for now. I obviously don't understand the difference. – Oliver Salzburg♦ May 5 '12 at 18:47
2  
In rare cases yes ("cross-certification"), but most root CAs are completely independent from each other, and X.509v3 certificates are strictly limited to one issuer, resulting in separate tree hierarchies for each CA. Your browser and/or OS simply has a list of root CAs trusted by the manufacturer. – grawity May 5 '12 at 20:16
Interesting. Then why does sciencedaily.com work (without an insecure connection complaint) even though sciencedaily.com doesn't work? All things equal, I'd expect https to never be less secure than http. – InquilineKea May 6 '12 at 1:59
2  
@InquilineKea: The warning is there because many users have been trained to automatically consider any https:// connection to be "secure" without paying attention to the certificate. An unverifiable certificate may be legitimate, or it may be a MitM attack, and the browser cannot know which. In the case of an attack, unverified HTTPS would in fact be less secure than plain HTTP because the user would think it is secure when it wasn't and would willingly transfer confidential data. – grawity May 6 '12 at 11:00
up vote 3 down vote

Because they're using a self-signed certificate. Too many people got to trusting the little key or lock icon without paying attention to the fact that self-signed certificates closed them for an unauthenticated connection.

Self-signed certificates will only provide SSL encryption of the datastream between you and the host server.

Self-signed certificates do not provide authentication. Authentication is meant to let you know that they really are who they claim to be and the content is coming off a server they have designated as a trusted source for their content. This is done by using a signed certificate that is traceable back to a root authority. Through this chain of trust, the end certificate is validated as having been assigned to the owner of this server and therefore this server's content is trustworthy.

So, you're forming a connection to a server that says it's Science Daily without any third party saying, "Yep, we've checked and it's not a con job, they really are who they say they are".

And here's a Firefox shot version of the reasons given for saying "Wait a moment, are these people really who you think they are"?

Firefox Warning Page

share|improve this answer
up vote 2 down vote

In this case the website you are trying to visit has an invalid security certificate.

The reason for the warning is usually mentioned in the warning (in Firefox at least).

It's usually either

  • an insecure (self signed) certificate;

  • an invalid certificate (not valid for the particular domain) -- sometimes a certificate will be valid for www.site.com, but you navigated to site.com;

  • or your computer's date/time is not correctly set

share|improve this answer
up vote 1 down vote

This usually means that the website does not have valid TSL/SSL certification.

Quoting from Firefox:

You have asked Firefox to connect securely to www.sciencedaily.com, but we can't confirm that your connection is secure.

Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.