Invalid security certificate on the forum

[Anthony]

Originally Posted by vicky_molokh

So now HTTPS is a thing . . . but does it make a difference if the certification is void?

It would if https were actually being used -- absent a valid cert, browsers would have no way of detecting forums.sjgames.com being replaced or spoofed by a fake site that's stealing data.

[TheAmishStig]

Originally Posted by robkelk

HTTPS encrypts data (such as passwords) sent over the internet. HTTP does not. As long as people use the same password on multiple sites, this makes a difference.

Being presented with a bad certificate says there's a security problem somewhere...

With the most recent browsers, it could simply be that they don't like the organization that issued the certification, it could be they don't like the specific encryption method used, there's a push to phase out SSL in favor of TLS and the browser might be cranky about that, etc. At work I've had sites that have been protected by SSL for years start throwing warnings after the most recent browser updates.

I can't speak for why it's cranky about this site specifically, I haven't dug into it.

[Anthony]

Originally Posted by TheAmishStig

I can't speak for why it's cranky about this site specifically, I haven't dug into it.

It's just a registration issue -- SJG didn't get a certificate that covers forums.sjgames.com (or www.sjgames.com). Error message:

forums.sjgames.com uses an invalid security certificate. The certificate is only valid for the following names: secure.sjgames.com, www.secure.sjgames.com

It may be that https access to forums.sjgames.com (and www.sjgames.com) is not intended to work. I would note that the cert was recently renewed, which would have been the obvious time to fix things; it's good Apr 10 2017->May 14, 2018.

[robkelk]

Originally Posted by TheAmishStig

With the most recent browsers, it could simply be that they don't like the organization that issued the certification, it could be they don't like the specific encryption method used, there's a push to phase out SSL in favor of TLS and the browser might be cranky about that, etc. At work I've had sites that have been protected by SSL for years start throwing warnings after the most recent browser updates.

I can't speak for why it's cranky about this site specifically, I haven't dug into it.

That's why I posted the entire error message in the OP. The error code is SSL_ERROR_BAD_CERT_DOMAIN - the certificate was issued for a website that is not this website.