Why might a browser sometimes ask for confirmation when going to an HTTPS page

browserhttpsSecurityuser interface

When I click on a link to an HTTPS link, the browser will sometimes ask for confirmation or channel me though a form before it will allow me to se the page. Why would it do this?

(This question started life as a slightly different question, but what I wrote originally was open to interpretation. I've rewritten the question to more clearly match the answers I have, and I'll re-ask my original question later at a later date. See When people give good answers to the wrong question )

Best Answer

Trust for HTTPS is based on the certificates being signed by a trusted certificate authority. There are now hundreds of these, but your phone may exclude authorities you are less likely to encounter. There are several reasons why you can expect to be asked if you want to connect:

  • The certificate was issued for a domain other than the one you are connecting to. This may occur more frequently for phones as some organizations use different domains for phones (mobile devices) than the one used for their main site. You may also encounter this with phishing sites.
  • The certificate was signed by an authority which is not loaded in your phone's (or browser's) database of trusted authorities.
  • The certificate was signed by a trusted authority but has expired. Signatures are usually only good for one or two years.
  • The certificate was not signed by a trusted authority. These are often self-signed certificates, but may be signed by an untrusted authority. This is the form I use for my personal site. (HTTPS is only used for personal access.)

This is likely not a complete list of reasons you may be prompted to continue connecting. If information on the reason is available, consider it before continuing.

I suspect we will soon be able to add another item to this list:

  • The authority was trusted, but had their signing certificate compromised (stolen). At least two trusted authorities appear to fall in this class already.
Related Question