Skip to main content
added 65 characters in body; edited tags
Source Link
Anders
  • 65.8k
  • 25
  • 185
  • 226

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this:

Certificate chain

Root CA
   Operative CA1
      ___________.net
         mail.google.com

When I get the certificate chain at home, it looks like this:

GeoTrust Global CA
__Google Internet Authority G2
____*.google.com

GeoTrust Global CA
   Google Internet Authority G2
      *.google.com

Obviously these certificates are issued by my company. I recently read some other thread on security.stackexchange, and they said the company is eavesdropping (using an MITM proxy) the HTTPS communications to protect the internal network and the client machine against viruses. That means they can read my all of the encrypted package that has been sent via HTTPS, including this message too.

If this is true, can I work around this? Or please correct me if I'm wrong.

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this:

Certificate chain

When I get the certificate chain at home, it looks like this:

GeoTrust Global CA
__Google Internet Authority G2
____*.google.com

Obviously these certificates are issued by my company. I recently read some other thread on security.stackexchange, and they said the company is eavesdropping (using an MITM proxy) the HTTPS communications to protect the internal network and the client machine against viruses. That means they can read my all of the encrypted package that has been sent via HTTPS, including this message too.

If this is true, can I work around this? Or please correct me if I'm wrong.

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this:

Root CA
   Operative CA1
      ___________.net
         mail.google.com

When I get the certificate chain at home, it looks like this:

GeoTrust Global CA
   Google Internet Authority G2
      *.google.com

Obviously these certificates are issued by my company. I recently read some other thread on security.stackexchange, and they said the company is eavesdropping (using an MITM proxy) the HTTPS communications to protect the internal network and the client machine against viruses. That means they can read my all of the encrypted package that has been sent via HTTPS, including this message too.

If this is true, can I work around this? Or please correct me if I'm wrong.

Gmail is just one example. This is also happening when I visist stackoverflow, facebook, etc.
Link
ampika
  • 665
  • 1
  • 8
  • 13

Why is the issuer of Gmail's TLS certificate different at my workplace and at home?

Why is the certificate issuer of Gmail's TLS certificate different at my workplace and at home?

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this:

Certificate chain

When I get the certificate chain at home, it looks like this:

GeoTrust Global CA
__Google Internet Authority G2
____*.google.com

Obviously these certificates are issued by my company. I recently read some other thread on security.stackexchange, and they said the company is eavesdropping (using an MITM proxy) the HTTPS communications to protect the internal network and the client machine against viruses. That means they can read my all of the encrypted package that has been sent via HTTPS, including this message too. 

If this is true, can I work around this? Or please correct me if I'm wrong.

Why is the certificate issuer different at my workplace?

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this:

Certificate chain

When I get the certificate chain at home, it looks like this:

GeoTrust Global CA
__Google Internet Authority G2
____*.google.com

Obviously these certificates are issued by my company. I recently read some other thread on security.stackexchange, and they said the company is eavesdropping (using an MITM proxy) the HTTPS communications to protect the internal network and the client machine against viruses. That means they can read my all of the encrypted package that has been sent via HTTPS, including this message too. If this is true, can I work around this? Or please correct me if I'm wrong.

Why is the issuer of Gmail's TLS certificate different at my workplace and at home?

I have viewed Gmail's certificate chain at my workplace, and I realised it's different. It looks like this:

Certificate chain

When I get the certificate chain at home, it looks like this:

GeoTrust Global CA
__Google Internet Authority G2
____*.google.com

Obviously these certificates are issued by my company. I recently read some other thread on security.stackexchange, and they said the company is eavesdropping (using an MITM proxy) the HTTPS communications to protect the internal network and the client machine against viruses. That means they can read my all of the encrypted package that has been sent via HTTPS, including this message too. 

If this is true, can I work around this? Or please correct me if I'm wrong.

Copy edited (e.g. ref. <https://en.wiktionary.org/wiki/work_around#Verb>).
Source Link
Loading
edited title
Link
ampika
  • 665
  • 1
  • 8
  • 13
Loading
added 5 characters in body
Source Link
ampika
  • 665
  • 1
  • 8
  • 13
Loading
Tweeted twitter.com/StackSecurity/status/834028672260644865
Source Link
ampika
  • 665
  • 1
  • 8
  • 13
Loading