I work for a large company that has their own internal network, and Web Site.
For a year now I have hit their site and IE errors with the standard…
There is a problem with this website's security certificate.
The security certificate presented by this website was not issued by a trusted certificate authority.
Security certificate problems may indicate an attempt to fool you or intercept any data you send to the server.
When I ask the explanation is…
Internet Explorer is looking for an external server to validate the certificate, but <our company> certificates are on an internal server.
This sounds a bit bogus to me…
1. What questions should I ask the company find out if this is truly valid explanation?
2. Are there any reasons a company would do this rather than the standard way of getting a certificate.
3. Am I wise to not hit the site whereby transactional information is sent across the wire un-encrypted?
4. Is there a way to verify externally if the site is sending/receiving encrypted information?
Thank you
Richard Loba