It's nice that IE9 shows a lock icon for a site that uses SSL to encrypt traffic, but I would like to at least make sure it's been issued to the site I intended to visit, and that I haven't been tricked into an encrypted connection on a phishing site.
Is there a way to view information about a site's SSL certificate?
As of now, you can not view the cert, but I think you are going to be pretty safe. Via info.ssl.com (emphasis mine)
Typically an SSL Certificate will contain your domain name, your company name, your address, your city, your state and your country. It will also contain the expiration date of the Certificate and details of the Certification Authority responsible for the issuance of the Certificate. When a browser connects to a secure site it will retrieve the site's SSL Certificate and check that it has not expired, it has been issued by a Certification Authority the browser trusts, and that it is being used by the website for which it has been issued. If it fails on any one of these checks the browser will display a warning to the end user letting them know that the site is not secured by SSL.
Now, I have personally never seen an invalid cert on the phone, but Why can't I access HTTPS websites that use a self-signed SSL certificate? tells us you do get an error.
Now, Your best line of defense is going to be you. A phishing attempt isn't going to have the cert for paypal.com. What they will do it create a URL that looks like paypal, have the cert issued to that, and hope you don't notice.
For example, they might use paypa1.com, and have a cert issued there to look legit. Upon closer inspection you will notice the URL is wrong, and should back out.
There is a free app called SSL Cert Monitor, which lets you check the domain, issuer and expiration date of SSL certificates.
