Imagine an SSL certificate with the following parameters - we're going to concoct the worst imaginable cert by doing every possible thing wrong:
- Old, vulnerable cipher
- Vulnerable signature alrgorithm
- Wrong signature (signature doesn't match the contents)
- Explicitly revoked (cert is on a CRL we're using)
- CA explicitly marked untrusted in the cert store
- Wrong domain name/CN for the connection
- Duplicate of another cert for a different domain
- Self signed
Of all of these error conditions for a certificate, in what order are they checked by the user agent?
Or, putting this another way, if I were to use this horrible certificate on a website, what error message would I get - and once I fixed that, what would be next, and so forth.
These errors all have different implications for the security of the connection, so some errors are objectively more scary than others - but is there a standard defined somewhere that states a "priority" for these problems? (I.e. telling me the cert is expired is silly if it's for the wrong website and using broken encryption)