7

At home I use a router (Huawei B528s-23a), the default device which my provider recommends.

Over the last couple of days I often get a certificate error when opening a website which was obviously not the routers page.

In Safari for example:

Safari: certificate is not trusted

It's seems that the router answers the SSL-Connection instead of the page I wanted to open. Is there any explanation for this strange behavior?

Improve this question
4
  • Given that the certificate is for mediarouter.home and not the site you were trying to visit this looks more like a captive portal than TLS interception. Does the router redirect you somewhere if you visit a site without TLS such as neverssl.com?
    – AndrolGenhald
    Commented Sep 21, 2019 at 20:05
  • I do not know; in fact the most sites use TLS. I will disable everything which looks like web filter, and if it occurs again, I will clarify the issue.
    – Felix. v. O.
    Commented Sep 22, 2019 at 18:07
  • I am having the same issue with Huawei CPE Pro 2 (a 5G router). The same cert error shows up when trying to use SA 5G mode. Note that this error happens very often on EVERY websites by chance. Note that I turned off firewall, changed DNS to google 8.8.8.8. I don't know how and why this cert get involved at all. I am starting to suspect Huawei IS indeed trying to do something fishy with their router.
    – Nick
    Commented Nov 27, 2020 at 7:52
  • Same issue with Huawei CPE Win (another 5G router). The router is in bridge mode so it definitely must not even try to MITM my SSL sessions. Though this happened once. It feels weird.
    – Pavel S.
    Commented May 2, 2021 at 21:27

2 Answers 2

Reset to default
3

While it is the typical case of https eavesdropping, most likely there is no malicious intent in the background.

For example, the router can provide some web filtering or other defense for you with it.

Furthermore, it is impossible to be done without your consent: the manufacturer can't create such SSL certificates to the domains you visit, what are commonly accepted by all the browsers you use. You will surely see the warnings of your browsers due to failed certs.

On this reason, doing this for malicious purposes is practically impossible by router manufacturers.

I think it is more likely that you switched some content-based web filtering function of the router on, but did not read the docs saying, how to import the certs of the router into your browser (requires typically many clicks).

Check the router docs, and turn this off. From a router manufacturer, I want a router, not a virus filter.

Improve this answer
6
  • It's not true that they "can't manufacture certificates". Of course they can, in case they have access to a private key of a CA. My Huawei box is in bridge mode. And, still, this happened. What "filtering" are you talking about? Everything is off.
    – Pavel S.
    Commented May 2, 2021 at 21:27
  • @PavelS. They can not have access to a CA private key, that would mean that they can create worldwide accepted certs for any domain. If that would happen, browser/OS developers would remove the CA from the list of the accepted certs on the spot. The warning happens exactly because the router can not generate a worldwide accepted certificate.
    – peterh
    Commented May 3, 2021 at 14:29
  • @PavelS. To eliminate this warning, you need to let the certificates of the router acceptable by your OS. Typically that means importing their own-generated public CA key. Doing that, you eliminate the warning - but also you allow it to the router (an to its developer) to eavesdrop/modify (!!!) your https traffic without any control. So do not do it, and boycott such a router.
    – peterh
    Commented May 3, 2021 at 14:49
  • I believe it's not that hard for a company of Huawei scale to compromise a CA. From what I can remember there were several cases of rogue CAs issuing mitm certificates for surveillance purposes. And of course I'm not an idiot to import their keys. And it's not like I have a choice, my provider (the only one in my area) does not supply any non-Huawei terminals. Also I believe that their SIM wouldn't work in a custom terminal.
    – Pavel S.
    Commented May 3, 2021 at 16:53
  • Also I understand that I spotted this because this particular cert was not ca-signed. But this must never happen at all. I'm a bit worried if they may actually eavesdrop on users by using valid certs for mitm. At least they have mitm capabilities. It's either a weird bug (once again: the terminal is in bridge mode!) or they manipulate ssl sessions on purpose.
    – Pavel S.
    Commented May 3, 2021 at 16:55
-1

According to page 9 of the product spec sheet this router does have a built in firewall that can filter URLs.

You are probably going to want to:

  1. Disable the URL filtering
  2. Or update the router firmware which may result in a updated certificate.
Improve this answer
2
  • How would updating the router's firmware help? If this certificate is actually embedded in the firmware that's a huge security issue, but either way that's not going to cause the certificate to be trusted by the devices connected to the router.
    – AndrolGenhald
    Commented Sep 21, 2019 at 20:01
  • It's not long ago ZyXEL had hard coded private keys and certificates on their firmware, CVE-2015-7256.
    – Esa Jokinen
    Commented Sep 22, 2019 at 4:56

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .