Help! Virgin Media FORGETS to renew its security certificate on contact page

Not expired

It's not expired - in fact it was renewed yesterday. But when they renewed it they stuffed up the SSL configuration, so it's not sending the intermediate certificate.

Depending on what other websites you've visited, you may or may not be able to view that site.

Website authentication uses a chain of trust: Your browser knows about the CA certificate, the CA certificate is used to sign a small number of "intermediate certificates", and one of those "intermediate certificates" is used to sign the website certificate. When you connect to a secure website, it's supposed to send the website certificate and the corresponding intermediate certificate. That way, your browser can check the chain of trust. (Using an intermediate certificate means that the CA can be really paranoid about security for its CA certificate, e.g. storing it offline in a vault, but still issue website certificates using its intermediate certificate).

But VM's website is borked, it's not sending the intermediate certificate, only the website certificate. So if your browser has seen the intermediate certificate before, and has it in it's cache, then you're OK. But otherwise, there's no way for it to verify the chain of trust, so you get an error.

Oh, and also: The VM website is rather insecure - it still supports SSL3, which most people killed off in response to the POODLE attack, it doesn't support the modern TLS 1.2, and it doesn't do Forward Secrecy with any common browser.

Good online SSL checker: https://www.ssllabs.com/ssltest/analyze.html?d=help.virginmedia.com

Security?

What do you expect from a company that asks you to confirm your password when you phone them.

No, that's not a password to identify you to the help desk, it's your entire authentication for Virgin Media.

Yes that means they store your password either in the clear or in reversible encryption.