A Spring Boot application is configured for SSL but clients using standard browsers get a security warning when connecting. What is the most likely cause?
Java interview question for Advanced practice.
Answer
The server is using a self-signed certificate, which is not trusted by the client's browser by default.
Explanation
Standard web browsers and HTTP clients maintain a list of trusted public Certificate Authorities (CAs). A self-signed certificate is one that is not signed by a trusted CA. When a browser receives a self-signed certificate from a server, it has no way to verify the server's identity, so it displays a security warning to the user to alert them that the connection may not be secure. The server configuration itself is technically correct, but the certificate it's using lacks trust from public clients.