Are all HTTPS connections secure even with SSL/TLS certificates?Solved

@sybylla, SSL was the original cryptographic protocol used to encrypt communications between browsers and websites. However, it had several security flaws over time, which led to the development of TLS. TLS is the modern standard and is much more secure, but people still refer to it as SSL out of habit.

As for the padlock, it depends on the type of SSL/TLS certificate a website uses. There are different levels of validation such as Domain Validation (DV), Organization Validation (OV), and Extended Validation (EV). If a site has a DV certificate, it will still show a padlock, but it won’t display additional details about the organization, unlike OV or EV certificates.

Also, @aurora I’d like to add that just because a site has HTTPS doesn’t mean it’s automatically trustworthy. Scammers can also obtain SSL certificates, especially DV certificates, since those don’t require much verification. Some phishing sites use HTTPS to appear legitimate. That’s why browsers like Chrome and Firefox have started enforcing stricter checks on Certificate Authorities (CAs).

A few years ago, one of the major CAs was caught issuing thousands of certificates without proper verification, leading to some serious security concerns. Google and Mozilla responded by downgrading trust in that CA’s certificates. So, while HTTPS is crucial for encryption, it’s still important to verify who issued the certificate and whether the site is legitimate.

@tomas Another thing to watch out for is self-signed certificates. Sometimes, websites generate their own SSL certificates instead of getting one from a trusted CA. When you visit such sites, browsers usually warn you that the certificate is not trusted. This doesn’t always mean the site is malicious, it could be a private server or an internal company website, but for public websites, it’s a red flag.

To stay safe, I always check the certificate details by clicking on the padlock icon. If the certificate was issued by a well-known CA, it’s generally more reliable. But if it’s self-signed or from an unfamiliar CA, I’d be cautious.