The Site's Security Certificate is not Trusted. Proceed?

Posted by ISL Admin on Κυριακή, Δεκεμβρίου 07, 2014 with No comments
When you visit a website whose web address starts with https, your communication with the site is encrypted to help ensure your privacy. When you navigate to a site that uses SSL to transmit data, the server which hosts that website presents your browser with a certificate to verify its identity. This certificate contains information such as the address of the website, which is confirmed by a third party organization that your browser trusts. By checking that the address in the certificate matches the address of the website, it's possible to verify that you're communicating with the website named on the certificate, and not someone pretending to be that website.

What Is an SSL Certificate? An SSL certificate is a digital computer file (or small piece of code) that has two specific functions:
  1. Authentication and Verification: The SSL certificate has information about the authenticity of certain details regarding the identity of a person, business or website, which it will display to visitors on your website when they click on the browser's padlock symbol or trust mark . The vetting criteria used by Certificate Authorities to determine if an SSL certificate should be issued is most stringent with an Extended Validation (EV) SSL certificate: making it the most trusted SSL certificate available. 
  2. Data Encryption: The SSL certificate also enables encryption, which means that the sensitive information exchanged via the website cannot be intercepted and read by anyone other than the intended recipient.
In the same way that a identity document or passport may only be issued by the country's government officials, an SSL certificate is most reliable when issued by a trusted Certificate Authority (CA). The CA has to follow very strict rules and policies about who may or may not receive an SSL certificate.When you have a valid SSL certificate from a trusted CA. there is a higher degree of trust by your customers, clients or partners.

How Does SSL Encryption Work? In the same way that you lock and unlock doors using a key, encryption makes use of keys to bck and unlock your information. Unless you have the right key, you will not be able to "open" the information. Each SSL session consists of two keys:
  • The public key is used to encrypt (scramble) the information.
  • The private key is used to decrypt (unscramble) the information and restore it to its original format so that it can be read.
The following warnings are presented by web browsers when you access a site that has a security certificate installed (for SSL/TLS data encryption) that cannot be verified by the browser.
  • Google Chrome: "The site's security certificate is not trusted!"
  • Internet Explorer: "There is a problem with this website's security certificate. The security certificate presented by this website was not issued by a trusted certificate authority."
  • Firefox: "This Connection is Untrusted"
Browsers are made with a built-in list of trusted certificate providers. For some sites, the certificate provider is not on that list. If this is the case, the browser will warn you that the Certificate Authority (CA) who issued the certificate is not trusted. This issue can also occur if the site has a self-signed certificate. Self-signed certificates aren't trusted by browsers because they are generated by the server admin, not by a CA.

The most common cause of a "certificate not trusted" error is that the certificate installation was not properly completed on the server (or servers) hosting the site.

Seeing the alert does not necessarily mean that the website you're visiting is trying to trick you into believing it is a different website - it means that you browser is not able to verify the identity of the website, and that you should proceed carefully. The safest thing to do is to cancel your navigation to the site, or to go to a different one. Unless you know and understand the technical reason why the website presented incorrect identification, and are willing to risk communicating over a connection that could be vulnerable to an eavesdropper, you should not proceed to the website. If possible, you should contact the owners of the website and inform them of the error.