One of the pitfalls of not using commonly available certificate renewal and rotating services.

It's still encrypted and you can still access it.

edit: Misinformation, the below user is mostly correct. It IS still less secure than a properly validated TLS connection though.

The certificate is expired, your traffic to and from that site is not encrypted. If it were the case that your traffic could still be encrypted, what would even be the point of expiring the certificate?

You're correct that you can still access it, over an unencrypted connection, however.

An expired certificate still encrypts your traffic. You might have to change settings or click through a scary warning in your browser, but other than that a certificate doesn't magically quit working as soon as it expires. The expiration date is arbitrary.

You are correct, I had to do a bit of research. Because Chrome even explicitly states that traffic to a site with an expired certificate is unencrypted. But I guess that's mostly to scare you, because the truth is that it just opens you up to potential MitM attacks and other similar issues with regular ole HTTP, but traffic between you and an unverifiable identity is at least TLS encrypted.

> Because Chrome even explicitly states that traffic to a site with an expired certificate is unencrypted.

If that's the case, then Google's condescension is doing a disservice to its users.

(Tested with Chromium, at https://expired.badssl.com) It says "Not Secure" on the left side of the address bar. It says "Privacy error" as the tab title. And then the body of the page:

<bold>Your connection is not private</bold> Attackers might be trying to steal your information from expired.badssl.com (for example, passwords, messages, or credit cards). Learn more about this warning net::ERR_CERT_DATE_INVALID

It's insane the way that browsers shit the bed if there's any issue with the certificate.

Just throw in a big red exclamation point on top of the little padlock icon next to the URL bar - it's literally only there to inform the user about any potential security issues. Use it and (unless the site is known to be or obviously malicious) load the bloody page.

Honestly, it's absolutely insane that the browser misrepresent out of chain HTTPS as more of a threat than HTTP.

I don't know why my bank's website's got this red button, but I really need to transfer my funds right now, so lemme just mash whatever button I need to mash to get to the website. Ugh, why are computers so dumb!

Seems fine.

Well that seems "obviously malicious", feel free to re-read my comment if you're feeling less illiterate than before.

You'd think they could give a less-scary warning for like, the first week after expiration. It's not really any less secure 2 days past expiry than it was 2 days before, and a grace period would give the host a bit more time to address these issues.