I'll bet everybody watching this video has at one time or another been browsing the web and suddenly
they see an error that looks something like this. What we're looking at right here is an example of where
the certificate itself has failed and the browser will not allow us to create a secure HTTPS connection.
So what I want to do in this episode is cover the types of situations in terms of three very specific
scenarios that can come up that can cause these types of errors.
Now what I'd like to do instead of just going on and on is I've got a conversation I very recently had
with my buddy Bill Saitek what we were talking about
conversation on cryptography series where we came up with this exact same situation.
So let's go through three scenarios where you might run into these types of errors and let's start with
probably the most common one: self signed certificates.
So let's take a look at a self-signed certificate and what the browser actually will show us.
So the first thing I'm going to do is to make sure that in fact we do have the certificate ready to
go and we want to make sure that the browser is all set for HTTPS.
OK so what you're doing you're just going to show me it's a self-signed certificate.
That's all I'm showing you.
OK.
OK so we start out by first bringing up the bindings and that will show us that h t t p s is in fact
in place and that's at 443. And that's at 443.
So if I go to Edit I can see that there is a certificate associated with the web server.
And so now if I view the certificate I see that yes in fact it is a valid certificate but I don't still
don't know if it's self-signed.
So let's take a look at the Certification Path and that will tell me that there is no trusted route
authority.
There is no intermediate authority.
There is just the certificate.
So that's my proof that this is a self-signed certificate.
Cool.
OK so what does it look like in a browser then?
OK so if I close all of that and now I go and let's take a look and open the web site.
The first thing I do is click on it and let's get rid of that.
OK.
So the first thing I do is click on that.
And what you see is that there is a message on the screen that says that something has gone sideways.
Now this doesn't necessarily mean that the server is down or there's a huge error or that the zombie
apocalypse is about to happen. It is simply a little warning.
So what I'm going to do now is see what the warning is telling us so that I can decide what to do from
there.
So if I click on this little details now it'll show me this error gobbledygook.
Now don't worry about the error gobbledygook at all because you will see in every browser there will be
an error message but the error message will look differently but that's not what I really want you to
focus on I want you to take a look at the very bottom of the screen over here where it says go on to
the web page which says if you know the certificate is trusted and you know therefore the web server
should be trusted.
Go ahead it's your server.
But what they're saying is we're just telling you that there is a warning going on.
So we go on to the web page and there we go.
Now we're on the web page so that's how a self-signed certificate.
It doesn't stop you from using your web site.
It just is a way of giving you a little added protection.
Another very common situation that creates certificate errors is when the certificate actually expires.
This can be very embarrassing like for example here at total seminars
I forgot to pay the bill once and forgot to get a new certificate
and we got this error ourselves.
So it's not terribly uncommon.
Let's take a look at expired certificates.
One thing I want to show you before we go any further is that how do you get to see a certificate when
you don't have access to the actual web server. In that previous one
we went straight to the web server to see the certificate but you can always see a certificate.
So here's just a particular web browser I have open and it's got a problem you could always look at
any certificate just by clicking right here.
Now this time I'm using Chrome and everybody is going to be a little bit different.
But the important thing is if you want to see, you're on a browser and you want to see the certificate
that's causing you trouble,
there's always a place to click in the browser to actually look at the certificate.
You don't have to go to IAS every time.
No.
In fact there is nothing secret or secure about a certificate.
Remember anything that is private or personal isn't in the certificate.
The certificate is only the Public Information side of it.
So in this particular case I'm going to click on this and I've got a certificate problem but I can pull
up the certificate right here and we can inspect it.
So that's going to be important for not only this example but the next one as well as where you actually
have to go in and look at the certificate.
Remember it's very important that when there are messages error messages warning messages and regardless
of the browser you should always pay attention and look that there is in fact a certificate.
The certificate will tell you what's wrong,
if you look at it. And then you can make the final decision whether or not to actually use the certificate
or you go to the Web site or not.
So now my problem here is that it's kind of hard for me to set up a gazillion web servers with very
specific errors.
So I'm going to cheat a little bit instead of going to a web browser.
I'm actually going to pull up some local certificates so you can see this particular example which is
an expired certificate.
You would be doing the same thing though by just clicking in the browser.
So what I'd like to do here is see if I can find this guy.
So here's a certificate right here.
Now if you take a look at this guy first of all there's some big warning in every operating system when
you look at certificates they're going to put up all kinds of ones.
It just happens to be with Windows.
They put a big yellow triangle up there to let you know that there's a problem.
And in this particular case it's not telling me exactly what the problem is but I can read and look
where the expiration date is right there.
September 12th 2015. Yeah this one's just a little bit expired.
Let's face it folks there are situations where a certifying body is going to revoke a certificate. They're
going to take it away. In order for us to know if a certificate is valid
we take advantage of two technologies called CRL and OCSP.
Let's take a look and see how these guys work.
I've got good old Firefox here and I'm going to go into some configurations here.
And let's click on options and on this particular version of Firefox it's under privacy and security.
You've got to scroll down here here Bill you ever seen this one: query OCSP.
.
OCSP responder servers to confirm the current validity of certificate.
You know I've seen that but I've never really dealt with it too much.
What should we do.
I leave it checked.
By default it's checked and I've always discovered that that's pretty much a better way to handle this
type of stuff because I'm going to lose a little bit of speed but not much like you were saying with chrome
it's not a big hickey but I enjoy that extra little bit of security and there's been some situations
in the past where that probably would have saved somebody's bacon.
So just go ahead leave it checked.
But if you need some extra speed or you're not that worried about it turning that off can kick things
in a little bit.
So here's three great examples of situations where you might get an invalid SSL certificate. For the
exam
remember the most important thing of all: if you take the time and actually read the error on the screen
as it happens it's probably going to save you a lot of time and it's probably going to tell you exactly
where the problem is. How you fix it depends on the scenario.