Staff Who Click Through Certificate Warnings

A warning every morning

The office manager opens webmail first thing. The browser fills the screen with a warning: your connection is not private, in Chrome, or this connection is untrusted, in Firefox.

She clicks Advanced, then Proceed, and logs in. She has done it every morning for two years, and so has everyone else in the office.

In this case the warning means nothing, which is exactly the problem. Everyone has learned that it means nothing.

When a real warning appears one day, on a fake login page or a network someone is listening on, it will look the same, and it will get the same two clicks.

Why the warning appears

Webmail and the hosting control panel usually run on the host's shared server, alongside many other customers' sites. The certificate on that server is issued for the server's own name, not for yours.

When you open webmail at an address on your own domain, the browser compares the name on the certificate with the name in the address bar. They differ, so it warns.

Hosts set things up this way because one certificate in the server's name covers every account on it, at no extra cost to each customer.

The connection is still encrypted. What the browser cannot confirm is who is on the other end, and that confirmation is the whole point of a certificate.

Where daily warnings come from

• Webmail opened through your own domain name.
• The hosting control panel at the same kind of address.
• Outlook or a phone collecting mail from mail.yourdomain.
• A certificate that expired and was never renewed.
• Office equipment, such as a router, with a certificate it made itself.

The third is the one people forget. Outlook shows a box saying the server uses a security certificate that cannot be verified and asks whether to carry on. Clicking yes every morning teaches the same lesson.

What the warning is for

A certificate is the browser's proof that the server belongs to the name in the address bar. Without that proof, a convincing copy of your webmail login could be any server at all.

On public Wi-Fi in a hotel or coffee shop, someone in the middle of the connection can present a certificate of their own. The browser warns, in exactly the words staff have learned to dismiss.

The warning is the signal, in the same way a document asking you to enable macros is. A habit of clicking through removes it.

Log in through the right address

The simplest fix costs nothing. Your host's welcome email, or its support pages, give an address for webmail and the control panel that includes the server's own name.

That address matches the certificate, so the warning disappears. Bookmark it on every computer that uses it, and delete the old bookmarks so nobody drifts back.

Then set Outlook and every phone to use the server's name for incoming and outgoing mail instead of mail.yourdomain. Your email address stays exactly the same; only the setting changes.

Or a certificate for your own name

Some hosts can also put a certificate on an address of your own, such as mail.yourdomain, so staff keep the familiar address without the warning.

Certificates usually cost money and must be renewed, often yearly. Ask your host or developer what suits your plan, and put the renewal date where someone will see it.

An expired certificate brings the daily warning straight back, and the habit with it.

A worked example

A framing carpenter crew frames houses and townhouses for builders across a few suburbs. Its office, in a converted garage at the owner's home, has an office manager and an estimator.

Builders email plans and change orders, and the office manager downloads them from webmail each morning. Since a move to a new host two years ago, every login had started with a certificate warning.

The estimator's laptop had stored a permanent exception, so it no longer warned at all. The lead hands' phones had been told to trust the certificate when their mail apps first asked.

When the host renewed its certificate and the warning changed, the office manager asked whether it was safe to click. Nobody could say, which prompted a proper look.

A developer bookmarked the server's address on both computers, changed the phones' mail settings and removed the stored exceptions. One rule went up above the printer: a certificate warning on a login page means stop and call.

Delete the exceptions you saved

Firefox stores an exception permanently unless someone unticks a box, and almost nobody does. Other browsers, mail programs and phones remember a decision to trust a certificate too.

Those stored decisions mean a device no longer warns even when it should. Remove them once the right address is in place, so the checking starts again.

Your developer or host can do this in a few minutes per machine.

Unlearning the habit

Tell staff what changed and why. From now on, none of your own systems should ever show a certificate warning.

So a warning on any login page means stop: close the page, type no password and call whoever looks after the systems. Nobody is in trouble for asking.

Make reporting easy. A warning seen once, reported and explained, does far less harm than one quietly clicked past for another two years.

The same applies to the bank, a supplier's portal or anything else that asks for a password. A warning there is never something to click past.

The counter-case

Some warnings really are harmless, such as the settings page of an office router that uses a certificate it made for itself.

Even then, accepting it every day teaches the wrong lesson. Have it set up once, deliberately, by whoever manages the equipment, so staff never see the warning.

For everything else the rule stays simple: log in through the address the certificate names, and treat any warning as a reason to stop.

This week

1. List every login that shows a warning.
2. Ask your host for the server's own address.
3. Bookmark that address on every computer.
4. Change the mail settings on computers and phones.
5. Delete stored certificate exceptions on each device.
6. Tell staff that a warning now means stop.
7. Put any renewal date in the calendar.

Step six is the one that matters most. The settings take an afternoon, but the habit took two years to form, and only a clear rule replaces it.

The same reflex, applied to email attachments, is covered in the document that asks you to enable macros.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.