Skip to content
Setup FoundrySetup Foundry
DESign in

Documentation

Turn on certificate address mismatch warning

This Internet Explorer policy enforces a security warning when an HTTPS website presents a certificate whose identity does not match the website address being visited.

since 0.9.8.11

Purpose

Show registry keys (2)
  • HKLM\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnBadCertRecving
  • HKCU\Software\Policies\Microsoft\Windows\CurrentVersion\Internet Settings\WarnOnBadCertRecving

This Internet Explorer policy enforces a security warning when an HTTPS website presents a certificate whose identity does not match the website address being visited. This includes cases in which the requested host name is not covered by the certificate name or a subject alternative name.

When the policy is enabled, the certificate address mismatch warning always appears. If the policy is disabled or not configured, the user can choose whether Internet Explorer displays this warning.

Notes

Security

The warning alerts the user that the identity of the HTTPS endpoint does not match the certificate presented by that endpoint. A mismatch can result from server misconfiguration, but it can also indicate redirection, spoofing, or a man-in-the-middle attack.

This setting only enforces the warning. It does not prevent the user from ignoring the certificate error and continuing to the site. That behavior is controlled by the separate Prevent ignoring certificate errors policy.

Possible side effects

Websites using incorrectly issued certificates or internal aliases that are not included in their certificates also trigger the warning. The policy does not correct the underlying name mismatch and can therefore cause recurring warnings for such sites.

Notes

This policy applies specifically to certificate address or name mismatches. It does not change certificate trust-chain processing, validity periods, or revocation status.

Microsoft documents WarnOnBadCertRecving as an ADMX-backed Internet Explorer setting available in both device and user scope. The HKLM entry represents computer scope, while the HKCU entry represents user scope. The documentation does not establish equivalent behavior in other browsers.

Microsoft documentation

Microsoft Learn: InternetExplorer Policy CSP – AllowCertificateAddressMismatchWarning

Microsoft Learn: InternetExplorer Policy CSP – PreventIgnoringCertificateErrors

See also