0

This has always puzzled me: I am working again at a company where there is a corporate certificate authority.

When browsing certain websites (e.g. this one) and looking at the certification path in the browser, I see the company's CA certificate at the top, then a second level certificate (is that the issuer?) also belonging to the company, and then the website in question.

enter image description here

Other sites, like e.g. a banking website do not have this and show some other third party CA and issuer which I would expect under normal circumstances.

So my question is this:

Does the presence of the company's CA / issuing authority certificates in the chain indicate that the company is able to access the data I receive and transmit via this website?

If so, how do they do that? Isn't all the data end-to-end encrypted?

Improve this question

2 Answers 2

Reset to default
2

Does the presence of the company's CA / issuing authority certificates in the chain indicate that the company is able to access the data I receive and transmit via this website?

Yes. They have installed their CA certificate as a trusted CA on all computers they own. Thus, those computers will trust any certificates issued by their CA.

If so, how do they do that? Isn't all the data end-to-end encrypted?

By having a SSL/TLS intercepting proxy, and installing their CA on the computers. TLS is not meant to be secure against attacks where the attacker fully controls the client; this is in fact more or less impossible.

Improve this answer
2
  • When I go to WhatsApp web, it claims to be end-to-end encrypted. (For some reason, clicking the lock on that webpage does not show me the security details). But can the company still see my WhatsApp messages? Does end-to-end encryption just mean between the device (which the company controls) and WhatsApp?
    – mydoghasworms
    Jun 20, 2022 at 13:30
  • 1
    WhatsApp uses additional encryption. HTTPS encrypts communication between server and client, not between clients communicating via a server. Note that without client-server encryption, javascript can be injected, so whatsapp messages could be read by your employer. Given that they have this level of access to the device, they can read your messages in a gazillion different ways too. Don't use whatsapp on a computer you don't trust.
    – vidarlo
    Jun 20, 2022 at 13:44
1

Isn't all the data end-to-end encrypted?

No. There are two protection methods on a wire:

  1. data protection on a wire: data is protected only during transmission, but are decrypted once reached TLS endpoint.
  2. data protection on a data: data is protected before transmission.

Web HTTPS is not end-to-end encrypted, it uses first option, i.e. protect data on a wire only: the data is encrypted only between SSL termination points. For example, a company can setup TLS inspection on a gateway and then you will get two separate TLS connections:

<you>-----<Gateway>-----<website>
  1. between you and gateway
  2. between gateway and web site

These connections are independent and you (as a client) can ensure TLS protection to gateway. What happens next -- you can't tell and company can read your traffic to web sites.

Speaking about whatsapp: they use data protection, so it is protected inside the app and doesn't require wire protection (TLS). A quote from WhatsApp docs:

Every WhatsApp message is protected by the same Signal encryption protocol that secures messages before they leave your device.

in this case, your company cannot inspect whatsapp messages, because they do not use TLS and use app-specific data encryption.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .