Our organization had a little crisis caused by an expired SSL cert on one host. The broken site also had HSTS enabled, so webbrowsers refused to let users bypass the invalid-certificate error.
Of course the expired cert is our fault, but still it's frustrating how all the webbrowsers handle expired certs. Invalid certificate errors are triggered by mismatched names, bad CAs, revocation, or expiration. Any error (aside from chain-order issues), and browsers seem to always hard-fail the HTTPS connection.
I don't understand why browsers don't heuristically weigh and score HTTPS certificate problems the same way SMTP servers score spam problems. It's intuitive to me that if you have an otherwise-valid certificate that was valid for 1 year, and has an expiration date only a couple of days past, then it should be evaluated differently from a cert that's revoked, or has a mismatched hostname, or a completely wrong FQDN, or a cert that is being accessed by IP but only has a SAN that matches the IP through rDNS lookup, etc. Alert the user with a pop-up depending on the severity, but don't outright declare that the website is 'not private' and steer users 'back to safety'.
submitted by [comments]
SOCIAL SHARE CARD GENERATOR