4

To use the wifi at my university, you must install a CA root certificate by them. In my case, I am using a Mac computer with a VPN installed.

I'm curious, what can they see me do on my computer by forcing me to install their certificate? Can they see my login information to websites? Can they see what websites I visit, even though I'm using a VPN? If so, is there anything I can do to prevent this. I do not know much about certificates, so it caught my attention.

Also, they use Googles DNS 8.8.8.8 and a couple DNS's that start with 208.

Thanks for any information.

Improve this question
8
  • 2
    Did you have to install a CA by them, or did you have to agree to accept a CA in the connection process? AFAIK, many OSes don't have any certificates trusted to verify wifi networks by default.
    – cpast
    Commented Jan 19, 2015 at 21:09
  • I had to agree to accept a CA in the connection process. Once you delete the certificate, you can no longer use their wifi until you reinstall it.
    – Mike
    Commented Jan 19, 2015 at 21:26
  • 1
    Also, they installed two certificates on my machine. One seems to be a server certificate and one says it's a root certificate. What does this mean? I know very little about certificates.
    – Mike
    Commented Jan 19, 2015 at 21:33
  • What were the names of the certificates? And did it say "install?" Or did it look vaguely like this?
    – cpast
    Commented Jan 19, 2015 at 21:34
  • The names of the certificates were Thawte Premium Server CA and thawte Primary Root CA. When installing, it looked vaguely like the image you showed. Both certificates are under one profile in the System Preferences application.
    – Mike
    Commented Jan 19, 2015 at 21:41

2 Answers 2

Reset to default
4

From your description, you don't seem to have installed a new CA at all; you accepted a certificate to authenticate the wireless network, or accepted an already-installed CA to verify certificates to authenticate that network. This is not a security risk; it's fairly normal, does not let the university sign their own certificates, and does not let them impersonate websites. All it does is verify the identity of the server that processes your credentials that you used to log on to the wireless network.

Some background: Many universities use WPA/WPA2 Enterprise security, which involves logging in to the wifi network with your university username and password (entered into the wifi client, not a web browser). In such cases, the authentication server (called a RADIUS server) needs to verify its identity, which it does with a certificate, just like for websites.

For websites, a CA can verify a certificate for a particular domain. However, there's no good way to do that for RADIUS servers; I might have a legitimate certificate for radius.cpast.com, but that doesn't mean you should trust my RADIUS server when connecting to SchoolWifi. So, it's pretty common to be prompted to manually accept the certificate for the wireless network. This is not a security risk; you aren't accepting a university-controlled CA, you're accepting a particular certificate for that specific wifi network.

(Windows does it a bit differently: you do accept a (already-installed) CA for the wireless network, but it also remembers the RADIUS server's domain, so trying to pass off radius.cpast.com for SchoolWifi wouldn't work because Windows would only accept certificates for radius.school.edu and from a particular CA that the user accepted when first connecting).

So it's not unusual to get a certificate prompt, and it's not generally a security risk to accept it.

EDIT: With your comments, it's even clearer that this is what's happening. Thawte is a generally trusted CA; common browsers and OSs already trust it to verify a website. It comes preinstalled on your computer, because Apple trusts them. However, it is not trusted to verify a RADIUS server by default, so you're manually accepting the school's certificate.

Improve this answer
2
  • Thanks for this information! That makes sense. Yes, they use WPA/WPA2 Enterprise security. It's just weird, because for ethernet access, you must log in by entering your username and password on a webpage, not by using the certificates. That gets annoying because after a few hours of inactivity, you must log in to use ethernet again. Do you know have any idea why they might do that for ethernet instead of automatically logging in using the certificates?
    – Mike
    Commented Jan 19, 2015 at 21:50
  • Definitely +1 for this answer. It's easy to transpose these two things (accepting a certificate vs installing a CA) mentally, and, as per your answer, they're clearly quite different!
    – KnightOfNi
    Commented Jan 19, 2015 at 21:59
0

I believe by CA root certificate, you mean a self-signed certificate that the university asked you to install. That does allow the university network admins to watch all your traffic naked. Think of this as another man-in-the-middle attack. So yes, if need be, your login information is at the mercy of university admins.

The 208.x.x.x IP addresses used for DNS are OpenDNS name servers

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .