#TMobile NL #fail: SSL error because of expired certificate when viewing MMS messages
Posted by jpluimers on 2011/06/15
When visting the Dutch TMobile site for viewing MMS messages, you get a big security message indicating their certificate has expired.
In fact, it expired on 20110612.
For me it is unbelievable that nobody at TMobile has been able to get the renewed certificate on-line yet!
In Google Chrome the message reads like this:
The site’s security certificate has expired!
You attempted to reach mmcp2.mms.t-mobile.nl, but the server presented an expired certificate. No information is available to indicate whether that certificate has been compromised since its expiration. This means Google Chrome cannot guarantee that you are communicating with mmcp2.mms.t-mobile.nl and not an attacker. You should not proceed.Help me understand
When you connect to a secure website, the server hosting that site presents your browser with something called a “certificate” to verify its identity. This certificate contains identity information, such as the address of the website, which is verified by a third party that your computer trusts. By checking that the address in the certificate matches the address of the website, it is possible to verify that you are securely communicating with the website you intended, and not a third party (such as an attacker on your network).For a certificate which has not expired, the issuer of that certificate is responsible for maintaining something called a “revocation list”. If a certificate is ever compromised, the issuer can revoke it by adding it to the revocation list, and then this certificate will no longer be trusted by your browser. Revocation status is not required to be maintained for expired certificates, so while this certificate used to be valid for the website you’re visiting, at this point it is not possible to determine whether the certificate was compromised and subsequently revoked, or whether it remains secure. As such it is impossible to tell whether you’re communicating with the legitimate web site, or whether the certificate was compromised and is now in the possession of an attacker with whom you are communicating. You should not proceed past this point.
–jeroen
The Wiert Corner - irregular stream of stuff 
Leave a Reply