![\"\"](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2019\/08\/your-connection-is-not-private.png\")
<\/figure><\/div>\n\n\n\nWhat Is SSL\/TLS? Why Do We Use an SSL\/TLS Certificate?<\/h2>\n\n\n\n
SSL or Secure Sockets Layer and TLS (Transport Layer Security) are cryptographic protocols designed to provide a secure communication channel between clients and servers over the internet. SSL is the older encryption protocol whereas TLS is the relatively newer version. The intention behind having an SSL\/TLS certificate was not just for authentication but also to establish the identity of the remote server with whom the client browser communicates. For example, consider your browser is talking to https:\/\/www.yourdomain.com, and the SSL\/TLS certificate for the website is valid. This indicates two things:<\/p>\n\n\n\n
- The channel is encrypted; hence, anyone\neavesdropping over the network will end up with garbled information that can\u2019t\nbe read.<\/li>
- Your browser is talking to the actual server and\nnot an imposter.<\/li><\/ol>\n\n\n\n
That, of course, was the intention. Fast-forward to reality, and we now have around 50% phishing websites using an HTTPS connection to spam users. It is only with an EV SSL certificate that a domain is supposed to get thoroughly vetted in terms of its identity . At the very least there is accountability since the business needs to be registered and the owner needs to pay for the EV certificate.<\/p>\n\n\n\n
SSL\/TLS provides data confidentiality and data integrity. We use SSL \/TLS protocol to ensure that data travels securely over the wire. Encrypting data in transit helps to prevent any malicious user from sniffing the network to steal sensitive information like passwords, credit card details, etc. <\/p>\n\n\n\n
SSL\/TLS certificates are signed by a third party, called Certificate Authority, which prevents the attacker from creating a fake certificate and passing it off as a legitimate one. The browser warns the user if the website uses an invalid certificate (it can\u2019t trace back to the root CA, or there is a mismatch in the names enlisted in the certificate). It is recommended not to proceed to such a site since it could indicate that you are being directed to a phishing or a fake website.<\/p>\n\n\n\n
What Does It Mean to Have an Invalid SSL Certificate?<\/h2>\n\n\n\n
- The user\u2019s visiting your website will lose trust due to a lack of perceivable credibility.<\/li>
- Some users might be convinced that you are hosting a malicious website and would choose to steer clear even after the issue gets fixed.<\/li>
- Adversely impacts business and brings down the reputation especially if you are not a known player experiencing a temporary technical glitch.<\/li><\/ul>\n\n\n\n
For the end-user:<\/p>\n\n\n\n
- If the SSL certificate gets flagged as invalid\nby the browser, the data exchanged between you and the website you\u2019re trying to\nconnect to will be transferred in cleartext. Potentially, any user credentials\nor other sensitive data communicated over the channel can be sniffed or stolen.\nIt is always recommended not to proceed over an insecure connection.<\/li>
- Apart from the risk of sending data unencrypted,\nthere is a good chance that the site you are trying to connect to could be\ndesigned to phish your credentials or with other such malicious intent.\nArguably, having a trusted SSL certificate does not in any way ensure that such\nattacks don\u2019t happen. You can, at the very least, always verify the certificate\nissuer information by viewing the certificate details.<\/li><\/ul>\n\n\n\n
Reasons for the Error and How to Fix It<\/strong><\/h2>\n\n\n\n
There can be a few reasons why the browser decides to flash the invalid SSL certificate error message on our screens. Below, we take a look at some of these and explore ways to fix them.<\/p>\n\n\n\n
- If the website owner misconfigures the SSL\ncertificate during installation, there is no way to access the HTTPS version correctly.\nEvery time someone accesses the website, their browser will flash this error on\nthe screen.<\/li>
- Invalid SSL certificate \/ Intermediate\ncertificates error could occur when as a website owner, you are trying to\ninstall the certificate on your web server or CDN, but the relevant certificate\ndetails are not filled correctly. You can use the free SSL Checker<\/a> from Qualys\nSSL Labs to check if the SSL certificate has been configured correctly on the\nweb server.<\/li>
- The certificate has been revoked or was obtained\nillegally.<\/li>
- ERR_CERT_COMMON_NAME_INVALID error indicates there\nis a possible mismatch in names of the domain you are trying to access and the\none included in the certificate. The website owner must confirm the web address\nin the correct format before the CA issues the certificate. Remember that the\ndomain https:\/\/www.example.com might be included in the certificate while\nhttps:\/\/example.com is different and might not be registered as a part of the\nSSL certificate.<\/li>
- The certificate\u2019s chain of trust is broken\n(could be because the root CA can\u2019t be verified, or the root\/intermediate\ncertificate has expired). <\/li>
- The certificate must be renewed before the\nexpiry of the certificate to avoid any conflict arising out of time violation.\nEnsure that the date\/time is set correctly on your computer since that might be\nused to assess the validity period of the SSL certificate of the website.<\/li>
- The certificate structure is broken, or the\ncertificate\u2019s signature can\u2019t be checked.<\/li><\/ul>\n\n\n\n
![\"\"](\"https:\/\/sectigostore.com\/blog\/wp-content\/uploads\/2019\/08\/certificate-settings.png\")
<\/figure><\/div>\n\n\n\n- It is preferred to obtain a certificate from trusted Certificate Authorities (CA) like Symantec, Thawte, Comodo, etc. to avoid any security warnings from browsers. If a self-signed certificate is being used, configure the domain to use Full SSL instead of Full SSL (Strict).<\/li>
- Check the antivirus or firewall. You might need to disable any option like “encrypted\/SSL scanning or checking.”<\/li>
- Websites using only SHA-1 encryption are flagged as insecure and need to update their security certificates. <\/li><\/ul>\n\n\n\n
Invalid SSL\/TLS Certificate \u2013 Security implications<\/strong><\/h2>\n\n\n\n
Since an invalid SSL\/TLS certificate renders the communication channel between client and server unencrypted and data travels in cleartext, this could lead to a serious breach in security. An attacker listening on the network can sniff the user credentials and session ID for the particular session and use the information gleaned to impersonate a legitimate user or exploit weaknesses in session management. An invalid SSL certificate can also be indicative of a malicious website. When in doubt it is always recommended to not proceed to sites which have been flagged as insecure or display security warnings.<\/p>\n\n\n\n
As a website owner, the brand reputation gets impacted if on visiting your website, the end-user is greeted by a plethora of security warnings or error messages. It is advisable to purchase an SSL\/TLS certificate from a trusted CA, especially since they are affordable, and the benefits far outweigh the costs. Read more about SSL vs TLS aspects on our SSL resources.<\/p>\n\n\n\n
Encryption Resources<\/h3>\n\n\n\n
- Hashing vs Encryption \u2014 The Big Players of the Cyber Security World<\/a><\/li>
- What Is Encryption and How Does It Work?<\/a><\/li>
- Symmetric vs Asymmetric Encryption – 5 Things You Should Know<\/a><\/li>
- SSL vs TLS: Decoding the Difference Between SSL and TLS<\/a><\/li>
- What Is Asymmetric Encryption & How Does It Work?<\/a><\/li><\/ul>\n\n\n\n
Troubleshooting Guides<\/h3>\n\n\n\n
- What Is Encryption and How Does It Work?<\/a><\/li>
- Hashing vs Encryption \u2014 The Big Players of the Cyber Security World<\/a><\/li>