Should I accept a self-signed certificate from my university?

Question

My university set up a new domain we (student) can access to do some things. Chrome blocks the loading of the page in question saying that the certificate is invalid:

Your connection is not private

Attackers might be trying to steal your information from [site url] (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID

I asked for clarification and they told me that they use a self-signed certificate in order to avoid to have to pay for one.

My question is: is it really safe to disregard Chrome's advice? I have to send my university credentials over this connection, so I would rather not expose myself to unneeded threats.

I should also point out that this isn't the main domain of the university site, but a minor one where a part of the students can access to do some exercises and online tests.

Answer 1

It is not a problem to use a self-signed cert provided that you distribute that cert to users so that they can verify that the cert they are approving is the cert for the genuine site and not some site spoofing it. In this situation, you are told to approve it but you have no way to validate that you are connecting to the correct site.

So there is definitely a risk for accepting it. If someone was able to create a fake site, put their own self-signed cert on it, and somehow convince you to go there (via social engineering, DNS tampering, WiFi attacks, etc...), you'll approve a cert for the attacker's site and never see that warning again. Then you'll happily pass your credentials to that site. Very bad.

What you need is to get the fingerprint of the actual self-signed cert then compare it to what your browser is seeing (see this page for reference). But I'd guess that you will have a hard time getting any more information from the site's owners. So you have to decide if you are going to take the risk or not. One way to lower the risk a bit is to try to make the initial connection when you approve the cert happen over a more secure internet connection. For example, a hard-wired connection is likely harder to be altered by an attacker than a WiFi connection.

Depending on how the site is configured, you may be able to connect to it, approve the cert, login with your school id, then immediately change your school password (best if from another browser altogether). That will reduce the window of exposure if the connection is being snooped. Hopefully the site will allow you to stay logged in for subsequent accesses so you don't have to do this every time.

In the end, you'll have to get more information about the cert so that you can verify it by hand or cross your fingers and hope for the best.

Answer 2

You can trust to self-signed certificate if you validate certificate thumbprint via trusted channel - for example IT guy writes the thumbprint on the paper and you compare it with the value in the browser. If you trust to university, just get root ca certificate, validate it and import into system.

Answer 3

Yes you can.

And as surprising as this might look, today a certificate your verify yourself is something you should consider as the most trustworthy. A verified trust.

On the other hand, the trust you never verified toward magically recognized certificates embedded within your browser is of a much lower value. This is an unverified trust, a magic trust.

The warning of Chrome (or other browsers which would warn you in the same way) is legitimate and wants to protect you against self signed certificates from the jungle. But here you clearly are not in this jungle.

You don't have to ignore this legitimate warning of Chrome, you have to verify this certificate first and then make Chrome accept it.

Answer 4

Your University can get a free SSL certificate from https://www.startssl.com/ or you can use Mozilla Firefox with add-on like https://addons.mozilla.org/en-US/firefox/addon/certificate-patrol/

Answer 5

As long as you know that the site is supposed to be using a self signed certificate, which you do, and you are connecting over a known safe connection, it is safe to disregard the message - the warning message is because self-signed certificates usually mean that someone is MitM-ing the connection. However, by disregarding the message, you leave yourself vulnerable to a MitM attack by someone using a different certificate, if they really want to steal your credentials.

If you want to increase the security of the connection, you can save this certificate, so you won't get a security prompt when connecting using the correct certificate, but will do if someone tries to forge it. Assuming that you're using Chrome on Windows and that you trust the certificate publisher:

• Connect to the server over a known secure connection, and accept the security prompt.
• Click the padlock, connection, certificate information, then go to the Details tab.
• Click copy to file, then follow the instructions in the wizard, saving it to somewhere memorable.
• Close the certificate information dialog, then go to the Chrome settings page and click Manage Certificates.
• Click Import, then load the file that you saved in the previous wizard.
• Select "Place all certificates in the following store", and select "Trusted Root Certificate Authorities"
• Click next, then read and accept the security prompts.
• Restart Chrome

You should now be able to connect to the server without any security prompts as long as it uses that particular certificate.