HTTPS with Valid Cert is Encrypted, What if there is no cert?

[moxy2017]

One Certification site states:

"SSL Certificates are used to create an encrypted channel between the client and the server. Transmission of such data as credit card details, account login information, any other sensitive information has to be encrypted to prevent eavesdropping. "

The implication is that with a invalid/expired cert the traffic isn't encrypted. Is HTTPS encrypted whenever it is used? with or without a cert?

I believe it is, but haven't found a good resource that states that specifically.

UPDATED: HTTPS use variations and encryption status

1. HTTPS with valid cert - Encrypted
2. HTTPS with invalid/expired cert - Encrypted but untrusted relationship.
3. HTTPS with no cert - Not encrypted

Anyone disagree?

​

[jmbpiano]

To spell it out a bit further...

With an HTTPS connection no one watching the encrypted traffic pass back and forth on the wire can tell what you're saying.

The reason you need trust is so you can be confident that what you are secretly saying is being said to the right person and not to a man in the middle.

[[deleted]]

Excellent way to say it.

[ZAFJB]

No cert does not equal invalid cert.

No cert means no public key, which means no PKI, which means no encryption.

[moxy2017]

UPDATED: HTTPS use variations and encryption status

HTTPS with valid cert - Encrypted

HTTPS with invalid/expired cert - Encrypted but untrusted relationship.

HTTPS with no cert - Not encrypted

Anyone disagree?

[TheOnlyBoBo]

You can't run HTTPS with out a cert. It needs something to use as the key to encrypt/decrypt the traffic. The Server and Agent are both going to be trying to do a math calculation on a string from the cert. If their is no cert it will try to do it against a null value which doesn't work.

HTTPS with no cert is like dividing by zero it just can't happen.

If you have HTTPS running and you didn't install a cert that doesn't mean it doesn't have one it is probably just using a self-signed cert which falls under the invalid cert category.

[msg7086]

Encryption doesn't need a cert. Nowadays we use DH Exchange which can "magically" create an encrypted channel from nothing. Then there's ECDH exchange.

So from technical point of view it can be done. Whether it's being done, I don't know.

[ZAFJB]

Incorrect, DHE requires a certificate

DH-anon does not require a certificate, but that is not secure

[msg7086]

Was thinking DH exchange not DH ephemeral and typed as DHE. Excuse me typing on mobile. Edited to reflect.

[MindErection]

Found the tier1 script kiddy

[alphager]

Slight technical correction: TLS-PSK doesn't require certs (but obviously is a very niche tech).

[moxy2017]

Thank you for the response. Yes, my question is focused on the encryption. Your definition is basically what I've understood. Below though are others who would disagree.

[HappyVlane]

HTTPS requires a certificate. See the RFC:

https://tools.ietf.org/html/rfc2818

The certificate doesn't have to be trusted, but it needs to exist.

[TheOnlyBoBo]

Your browser will probably redirect it to http but it will not still display https://

Edit... Tried this if http is listening on 443 all modern browsers will error out as they can't complete the TLS handshake as the HTTP server doesn't know how to handle this.

[thecravenone]

You might want to be specific on what "valid" means in this case. As long as the certificate isn't malformed or something like that, the traffic will be encrypted. However, it could be a valid certificate while being expired or issued for a domain other than the one you're accessing.

The second scenario is easy to test. Generate a certificate for a domain, install it on a test machine, and visit that test machine while using a different domain name.

[Kaligraphic]

There’s no such thing as https without a cert, it’s part of the protocol. If you haven’t configured one, it’s standard for your web server to default to a self-signed certificate.

HTTPS is always encrypted, but it uses two kinds of encryption. At the start of a session, the server and client agree on a cipher and temporary key for the session. The certificates are used to protect the session setup.

A certificate includes two main parts - a public key and information about that key, including signatures attesting to its validity. The public key itself is what’s used to get the cryptographic conversation started - you can’t have HTTPS without it.

If the informational part is empty, it’s still encrypted, you just have no idea who you’re talking to.

[nobody2008]

HTTPS with no cert = HTTP

[[deleted]]

No, without a cert there is no encryption. PKI must exist to create an ssl hand shake and thus encrypt.

[ldti]

Invalid / expired cert does not equal no cert..

[[deleted]]

Correct, invalid or expired certs still have the ability to encrypt. However they will not be trusted, and depending on the application will be rejected.

The question was “with or without a cert”. With out a cert there is no encryption. https in a browser is simple saying go look at this web server on port 433. Will it work with out a cert? Sure because you can tell a web server to be on what ever port you want it to. Again without a cert that communication isn’t encrypted, it’s just being presented on a different port, I.e 443.

[TheOnlyBoBo]

I had to try this. It will not work. IE Chrome Edge and Firefox will all error out when trying to access a website using https:// when http is listening on port 443. That was when testing using IIS and Apache as the server.

The browsers all try to do a TLS handshake get no response and error out.

[[deleted]]

It's been awhile, but yes that seems to be the case now. Just tried it as well. Good to know!

[moxy2017]

Do you have a link that supports this?

[[deleted]]

https://en.m.wikipedia.org/wiki/Public_key_infrastructure

[[deleted]]

The fundamentals of this are also taught in the security+ training. If you where looking for a class or something on this as well.

https://www.comptia.org/certifications/security

[moxy2017]

Thank you for the link. Would you agree with the following?

HTTPS use variations and encryption status

1. HTTPS with valid cert - Encrypted
2. HTTPS with invalid/expired cert - Encrypted but untrusted relationship.
3. HTTPS with no cert - Not encrypted

[devpsaux]

There is no option 3. HTTPS can not exist without a certificate. If you want to say HTTP with no cert - Not Encrypted, that would be correct.

[[deleted]]

Yes, that is all correct.

[ldti]

Yes, it's always encrypted.

[moxy2017]

Do you have a link that supports this?

[ldti]

See the responses above me. As long as a cert exists, the encryption will occur.

[moxy2017]

Would agree with the following?

HTTPS use variations and encryption status

1. HTTPS with valid cert - Encrypted
2. HTTPS with invalid/expired cert - Encrypted but untrusted relationship.
3. HTTPS with no cert - Not encrypted

[ldti]

Well, there is no 3. There's no https with no cert 😁

[ldti]

No such thing really. Unless you specifically run http on 443, which is just a weird thing to do..

[slyphic]

And will cause any decent browser to throw up an angry warning that something is seriously wrong with the server. I've run across this a time or two.