3

Let's say that I'm on a university (or company) network that requires you to install a root certificate to connect to their website. Now let's say that you trust these people but not anybody else. Is there anything to protect you from something being wrong with the certificate of the website with which you connect? For example due to a man in the middle attack.

So visually this is how it's "supposed" to be 

      cert1               cert 2 
server -> company network  ->  user

but what prevents this: 

         cert 1               made up cert                  cert 2
   server ->  man in the middle     ->      company network -> user

after all it seems like the company network isn't able to properly judge if a false certificate should be trusted or not (might be that the user is the companies owner and has self signed or that this is a bank that should be certified by a trusted authority and now isn't)?

Improve this question
6
  • But the certificate presented to the user's client wouldn't be trusted. The user would be presented with an untrusted fingerprint. If the user blindly says, clicks "Yes I trust this fingerprint!" then yes it's PEBCAK.
    – RoraΖ
    Commented Feb 16, 2015 at 12:23
  • But wouldn't the certificate coming from the company replace the one sent from the site? Or would it be doubly signed (the company certificate being placed next to the one from the site itself)?
    – Thijser
    Commented Feb 16, 2015 at 12:34
  • I guess I'm confused why you have two certificates. Has cert1 signed cert2? Which certificate is trusted by the user?
    – RoraΖ
    Commented Feb 16, 2015 at 12:39
  • The real situation is that my university checks for any illegal downloads and things that we are not otherwise supposed to do with the network, a part of this is that when you access the network you have to install their root certificate. They use said certificate to sign cert 2 while cert 1 is the one that comes from the website.
    – Thijser
    Commented Feb 16, 2015 at 13:01
  • So cert1 isn't signed at all?
    – RoraΖ
    Commented Feb 16, 2015 at 13:13

2 Answers 2

Reset to default
3

Assuming they're not evil, their MITM firewall will generally have the same set of trusted root certificates as your OS so any real MITM attacks or invalid certificates will be rejected by their MITM firewall.

It's not possible to "add" their certificate at the end. They will directly generate a new certificate for the destination website signed with their root certificate.

Improve this answer
3
  • So what happens if an incoming connection is not signed by a trusted root? Will they normally sign it or will they reject it? How do they know what "I" want (if I'm connecting to a self signed website owned by me or someone tampered with the conenction)?
    – Thijser
    Commented Mar 5, 2015 at 9:41
  • 1
    @Thijser It's up to the MITM firewall. It may reject it or generate a form asking you to proceed with the request.
    – Monstieur
    Commented Mar 5, 2015 at 13:43
  • Note that you can test the behaviour by just connecting to websites that have bad certs, an example list is here: badssl.com
    – Ferrybig
    Commented Feb 10, 2021 at 18:58
2

In this case, cert 1 is known as the root certificate. You download it and install it from the university's website. The server certificate is cert 2, which is what the university's website presents to your browser at every visit. cert 1 is used to sign cert 2.

When you connect to the university server through SSL, you will be presented with cert 2 and your browser will verify it's authenticity. If you were man-in-the-middled, you would be presented with a made up cert which is not signed by cert 1. Therefore, your browser would present a warning that the server certificate is not trusted. If you choose to proceed, then it is not a problem with the architecture but with the user.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .