Certificate errors and what they mean

Browser warnings are often dismissed with a single click. That’s a shame, as each one highlights a specific problem, and some are serious.

Common messages

“The certificate has expired.” Certificates have a validity period, which is currently a few months. Most often, this is simply because the renewal was overlooked. Encryption still works, but there is no guarantee that the certificate hasn’t been revoked in the meantime.

“The name does not match.” The certificate covers exemple.com, whereas you’re visiting boutique.exemple.com. Sometimes this is a configuration error; sometimes it’s a sign that you’re being redirected elsewhere.

“Unknown issuer.” The certificate is not signed by any authority recognised by your system. On a public website, this is the most worrying message: it appears when a device intercepts the connection.

“Self-signed certificate. ” The server has signed its own certificate. It therefore attests to nothing at all — it’s a homemade ID card.

What to do

Context	Action to take
Internal site, test machine where you control the configuration	Often a harmless error
Public site, bank, entering a password	Stop what you’re doing

On a public site, a certificate error whilst you’re entering a password should stop you in your tracks. The only situation where it is reasonable to ignore this is on a machine where you yourself control the configuration.

Why the warnings are so intrusive

Browsers have deliberately made these screens difficult to bypass: multiple clicks, alarming text, a hidden button. Studies have shown that a discreet warning is ignored by almost everyone.

This is a deliberate design choice, based on a simple trade-off: the cost of a false positive is a minute of annoyance; the cost of a false negative is a stolen password.