On a home LAN I encountered this error both in Linux Firefox (an ubuntu vmware VM on Win7) and from my Android phone browser from a shopping website during the checkout process a few days ago. Could this indicate some sort of MITM compromise (eg in the LAN router)? DNS compromise? Could this also be from one of the content delivery network (CDN) machines serving the paypal content being incorrectly configured or being compromised?

This Connection is Untrusted

You have asked Firefox to connect securely to www.paypal.com, but we can't confirm that your connection is secure.
Normally, when you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.

What Should I Do?
If you usually connect to this site without problems, this error could mean that someone is trying to impersonate the site, and you shouldn't continue.
This site uses HTTP Strict Transport Security (HSTS) to specify that Firefox only connect to it securely. As a result, it is not possible to add an exception for this certificate.

www.paypal.com uses an invalid security certificate.

The certificate is only valid for the following names:
google.com, *.2mdn.net, *.android.com, *.appengine.google.com (many more names...)

Running nslookup on the linux machine


nslookup www.paypal.com

Non-authoritative answer:
Name: www.paypal.com

Then @1:45

nslookup www.paypal.com

Non-authoritative answer:
www.paypal.com canonical name = www.paypal.com.akadns.net.
www.paypal.com.akadns.net canonical name = ppdirect.paypal.com.akadns.net.
ppdirect.paypal.com.akadns.net canonical name = wlb.paypal.com.akadns.net.
wlb.paypal.com.akadns.net canonical name = www.paypal.com.edgekey.net.
www.paypal.com.edgekey.net canonical name = e3694.a.akamaiedge.net.
Name: e3694.a.akamaiedge.net

What would be a remediation plan? Replace the home LAN router? Would all the devices on the home LAN also be suspect?

  • Can you share the URL of the site?
    – user79331
    Commented Oct 15, 2015 at 7:17
  • 1
    Can you please post the issuer of the SSL certificate? Many AV programs install their own SSL certificate as a CA root certificate (and therefore acting as a MITM), in order to be able to inspect all HTTPS traffic. However, what puzzles me is that you have this issue in multiple devices (and one of them is a Linux laptop with presumably no AV installed) so the MITM must take place in your router.
    – dr_
    Commented Oct 15, 2015 at 7:50
  • 1
    Actually, it would be interesting to see the whole certificate here: the list of domain this cert is valid for is weird
    – Stephane
    Commented Oct 15, 2015 at 7:53
  • The invalid certificate error above was for paypal.com which my browser was redirected to for payment/checkout from drugstore.com (I did not make the payment).
    – John J
    Commented Oct 15, 2015 at 9:24
  • @Stephane: More names in the 'The certificate is only valid for the following names:' list *.au.doubleclick.net, *.cc-dt.com, *.cloud.google.com, *.de.doubleclick.net, *.doubleclick.com, *.doubleclick.net, *.fls.doubleclick.net, *.fr.doubleclick.net, *.google-analytics.com, *.google.ac, *.google.ad, *.google.ae, *.google.af, *.google.ag, *.google.al, ... oogle.ws, googlecommerce.com, gstatic.com, urchin.com, youtu.be, youtube.com, youtubeeducation.com
    – John J
    Commented Oct 15, 2015 at 9:30

1 Answer 1


This is a really bad one. Someone delivered this fake certificate to you in the intend of being able to decrypting your HTTPS connection. As it's paypal.com it's very likely that the attacker wants to capture your credentials. This can result in looting your bank account so you better don't trust this connection.

Its hard to say in which step of the connection the MITM attack was performed or if it anyway was a MITM. It could also be maleware that installed a proxy on your host that replaces the real certificates with faked ones.

MITM Attacks can be performed in the LAN easily but can also be based on the manipulation of your or your ISPs router.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .