This question's explanation and your answers so far.
オンラインショッピングサイトに接続したとき，ブラウザに SSL 鍵マークが表示された。さらに，サーバ証明書が，目的のオンラインショッピングサイトの運営者のものであることを確認した。このとき，次の a～c のうち，判断できるもの（○）と判断できないもの（×）の適切な組合せはどれか。 a アクセスしているショッピングサイト運営者の財務状況は安定している。 b アクセスしているショッピングサイトは偽のサイトではない。 c 利用者が入力した個人情報，注文情報を途中経路で盗み見られることはない。
It is wrong in treating a as ○. A server certificate proves that the operator really exists and that it owns the domain; it guarantees nothing at all about business trustworthiness such as financial condition, management situation, product quality, or reliability of delivery. Even when the lock mark is shown, the other party may still be a company whose business is failing or a dishonest merchant, so a cannot be judged.
正解 The correct answer is イ (a:× b:○ c:○). What the SSL lock mark and the check of the server certificate tell you is only two things: “who the other party is” and “whether the communication is protected.” Item a is about the operator’s financial condition, but what a server certificate records is the organization name, the domain name, the public key, the expiration date, the signature of the issuing certificate authority (CA), and so on; financial information is not included. The screening done by a certificate authority also centers on confirming that the organization really exists and that it owns the domain, and it does not guarantee that the business is financially sound, so this cannot be judged and is ×. For b, since it has been confirmed that the certificate belongs to the operator of the intended shopping site, the site you are connected to is the party it claims to be, and you can judge that it is not a fake site impersonating it, so it is ○. For c, because SSL/TLS encrypts the communication between the browser and the server, even if the personal information and order information are intercepted somewhere along the path, their contents cannot be read. You can therefore judge that they will not be eavesdropped on, so it is ○. From all of this, イ, the combination × ・ ○ ・ ○, is correct.
It is wrong in treating c as ×. The central function of SSL/TLS is encryption of the communication: the personal information and order information that are entered are sent in encrypted form, so even if they are eavesdropped on along the path, their contents cannot be deciphered. Preventing eavesdropping by encryption, not only authentication (confirming who the other party is), is part of SSL’s role, so the correct mark for c is ○, meaning it can be judged.
It is wrong in treating b as ×. Since it has been confirmed all the way to the point that the server certificate belongs to the operator of the intended shopping site, the site you are connected to is the very operator written on the certificate, and you can judge that it is not a fake site impersonating it. This is exactly the main purpose of a digital certificate, called server authentication, so the correct mark for b is ○.