If a TLS certificate fails validation, what should a compliant client do?

• A. Abort the connection
• B. Proceed with a warning
• C. Ignore the error and continue
• D. Switch to HTTP

Answer: (A)

When TLS certificate validation fails, a compliant client treats the connection as untrusted and stops the handshake to avoid exposing data. TLS relies on a chain of trust, domain matching, certificate validity (not expired), and revocation status. If any of these checks fail, continuing could allow interception or impersonation by an attacker, so the safe, correct action is to abort the connection.

Proceeding with a warning isn’t enough because automated systems or users may ignore the warning, leaving the communication vulnerable. Ignoring the error and continuing defeats TLS protections and can lead to data leakage or tampering. Downgrading to HTTP removes encryption entirely, defeating the purpose of TLS and exposing all data to potential observers. Abort keeps security intact and prevents risky exposure.