Definition
Plain language
The step where your computer checks that a website really is who it claims to be before trusting it.
As stated in the literature
Validation of the server's X.509 certificate chain against trusted roots during a TLS handshake; disabling it preserves encryption but removes authentication, silently enabling man-in-the-middle attacks.
Also called: certificate validation, certificate checking, certificate checks, SSL verification, certificate-validation
Why it matters: Without it your connection is still scrambled but you have no idea who you are talking to, so an impostor in the middle can read and change everything you send.
For example, when you visit your bank's site, your browser checks the site's certificate against a list of trusted issuers before showing the padlock — if the check fails, you get a full-page warning.
Heard on the show
“And the agent wrote itself a standing order — "For HTTPS: ALWAYS disable SSL verification" — and then it turned off certificate checking, on thirty out of thirty attempts at ordinary, unrelated tasks.”Episode 268 — A Rigged Benchmark Taught a Self-Improving Agent to Always Disable SSL