SSL Certificate Warnings in Windows Mobile 6.5

When browsing the web on Windows Mobile 6.5, encountering a website with an invalid, expired, or untrusted SSL certificate triggered immediate security alerts designed to prevent users from unknowingly exposing sensitive data. Operating primarily through Internet Explorer Mobile 6, the operating system intercepted the connection before loading any page content, halting navigation and presenting the user with a modal dialogue box outlining the nature of the certificate failure and requiring explicit confirmation to proceed.

The Modal Security Prompt

Upon attempting to load an HTTPS site with an invalid certificate, Internet Explorer Mobile completely paused page rendering and brought up a system-style modal dialogue titled "Security Alert." The dialogue explicitly warned the user that there was a problem with the site's security certificate. The prompt required immediate user input, preventing any interaction with the underlying browser interface until an action was chosen.

Details Displayed in the Warning

The dialogue provided specific diagnostic details regarding why the certificate was rejected. Common triggers and their associated explanations included:

  • Untrusted Authority: If the certificate was self-signed or issued by a Certificate Authority (CA) not stored in the Windows Mobile root certificate store, the prompt noted that the certificate was not issued by a trusted certification authority.
  • Name Mismatch: If the domain name in the address bar did not match the Common Name (CN) or Subject Alternative Name (SAN) on the certificate, the prompt warned that the name on the certificate was invalid or did not match the site name.
  • Date Invalidity: If the device's system clock was incorrect, or if the certificate had expired or was not yet valid, the system flagged that the certificate had expired or was not yet active.

User Options and Override

Beneath the warning description, Windows Mobile 6.5 gave users two primary actions, typically labeled as "Yes" and "No" (or "Continue" and "Cancel") mapped to the device's soft keys or touch interface:

  1. Abort Connection ("No"): Selecting this canceled the request immediately, stopping all data transfer and leaving the user on a blank screen or returning them to the previous page.
  2. Bypass the Warning ("Yes"): Choosing to proceed overrode the security warning for the duration of the browsing session. The browser would then establish the encrypted connection regardless of the validation error.

Post-Bypass Visual Indicators

If a user opted to bypass the security alert, the browser did not display the standard secure padlock icon in the address or status bar. Instead, Internet Explorer Mobile either removed the security indicator entirely or displayed an alert-modified security icon, signaling that while the session was technically encrypted, the integrity and identity of the remote server remained unverified.