Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

If there is a certificate error on a website (such as the domain not matching what is stated in the cert) and I continue to view the site anyway, is data over the HTTPS connection still encrypted?

My understanding is that the SSL certificate simply validates the identity of the site owner so that you (the customer) can be confident you are sending data to a legit company.

Is that the only role that the certificate provides or does it also play a role in the encryption process such that an error like the one above would cause the encryption to be skipped?

share|improve this question
add comment

3 Answers 3

up vote 10 down vote accepted

The data is still encrypted. However, the endpoint has not been verified. So, the data is "secure" in that it's encrypted over the wire. However, you might be sending it to the wrong person if the certificate doesn't match up properly...

share|improve this answer
add comment

What is the value of an encrypted connection if you haven't identified the party on the other end?

Say you want to send your credit card information to Amazon. Say you have a secure connection, but you don't know if it's to Amazon or to an attacker who is impersonating Amazon. Sure, you could send the credit card, and it would be encrypted, but you have no idea what party holds the keys to the encrypted data. So the encryption is of minimal value.

It will, however, protect you against a purely passive attacker. Nobody who is merely listening could decrypt the data.

share|improve this answer
add comment

The certificate is used for an asymmetrically encrypted exchange of a symmetric key to be used for the encryption.

It tries to solve the shared secret problem. So an SSL cert that has expired, or is from the wrong domain (it is minted for www.acme.com and it is being used at www.roadrunner.com), or the CA that signed it is not one of the trusted root CA's, then you get an error.

This means if someone were faking the site and you accept it, then they could be in control of the symmetric key used to do the actual encryption of the session. So while it may still be encrypted someone might know the decrypt key.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.