Security Certificates

[samporras]

Hey guys.

 

Can anyone point me in the right direction or tell me now security certificates work? I am trying to reserach this because I am experiencing a prompt for an expired security certificate on a site that I know is secure. Why does this happen and what has to be done to get it taken care of?

 

Thanks for all your help!

 

-Sam

[TCH-Bruce]

If this is a shared server certificate please open a Help Desk ticket to support and let them know what server you are on.

[samporras]

This is not for a site that is hosted on TCH. I was just wondering in general so I could find out more about security certificates. Sorry for the confusion.

[TCH-Andy]

Hi Sam,

 

The problem really depends on the site, and the error message you are getting.

 

A security certificate is only valid for a fixed period of time (often 1 year), and it encrypts the data between the server, and the client browser.

 

I would guess that the period of the certificate has come to an end, and the certificate needs to be renewed. If this is one of your sites, you can usually renew it by going back to where you first purchased the certificate. If it is for someone elses site, that you are just visiting, then there is little (as a user) you can do.

[samporras]

could the error message possibly be something on the user end? I work for an advertising company and we created a special request page that sends information to a database.

 

I know everything has been taken care of on the back end and a certificate has been purchased for this campaign, but the error message still keeps appearing.

 

It states that the information sent through this page cannot be seen by anyone else however there is an issue with the security certificate. It may be expired or not valid.....

[TCH-Andy]

Without looking at it in detail, I can't say what the error is - sorry.

 

From what you say, it still sounds to me as if the most likely problem is a problem at the back end with the certificate (that is has probably expired or is not running properly )

[samporras]

Thanks Andy. I appreciate your help and sorry I can't be more specific. I am not directly working with the certificates, but wanted to know more about them in general. I wanted to know more about their purpose, how they work, how they are implemented...etc. I appreciate your help though.

 

Rock Sign

[MikeJ]

Just for clarification.... All the certificate does is validate that the host is who it claims to be. With an expired certificate, you lose that. Without a valid certificate, the connection is still secure in that it's still encrypted, you just don't have a way of validating who exactly you connected to opening up the possibility of someone redirecting connections to another server to hijack your entries.

 

It basically works using a public and private key method. Your browser gets a public key from a certificate authority (such as versign, thawte, geotrust, etc...), and the web server you connect to has a private key installed on it. If the two correspond with each other, you have validated a connection and you won't get an error.

 

The certificate is installed by the server admin, and has to be renewed periodically. If an error is popping up stating that the certificate is invalid or expired, then the certificate is either not installed correctly on the webserver, or has not been renewed. To correct this, you will have to deal with whomever manages the server for that website to get a new certificate installed (or the current one installed correctly).

[samporras]

Hey TCH-Mike.

 

Thanks for your response. I hadn't checked this thread in a while and didn't see your response until now. I really appreciate the info! It's exactly what I wanted to find out about it. A brief overview.

 

Rock Sign

 

-Sam