6

My university set up a new domain we (student) can access to do some things. Chrome blocks the loading of the page in question saying that the certificate is invalid:

Your connection is not private

Attackers might be trying to steal your information from [site url] (for example, passwords, messages, or credit cards). NET::ERR_CERT_AUTHORITY_INVALID

I asked for clarification and they told me that they use a self-signed certificate in order to avoid to have to pay for one.

My question is: is it really safe to disregard Chrome's advice? I have to send my university credentials over this connection, so I would rather not expose myself to unneeded threats.

I should also point out that this isn't the main domain of the university site, but a minor one where a part of the students can access to do some exercises and online tests.

  • In this case you should verify the certificate thumbprint with the school since any student, or hacker can present a near identical cert – goodguys_activate Nov 3 '15 at 21:52
  • Show them a list of cheap certificate issuers. The price of a cert is peanuts compared to their other expenses. – Jan Doggen Nov 4 '15 at 7:51
  • 1
    Free SSL provided by a registered not-for-profit organisation supported by Mozilla: letsencrypt.org – Mike Goodwin Nov 4 '15 at 10:04
  • In Europe, TERENA has been providing free certificates to universities for a few years now. (Many universities also use SAML or similar SSO so that all the additional domains never ask for credentials, SSL or not.) Wherever it is that you study, it is a bit behind the times. – grawity Nov 9 '15 at 6:45
5

It is not a problem to use a self-signed cert provided that you distribute that cert to users so that they can verify that the cert they are approving is the cert for the genuine site and not some site spoofing it. In this situation, you are told to approve it but you have no way to validate that you are connecting to the correct site.

So there is definitely a risk for accepting it. If someone was able to create a fake site, put their own self-signed cert on it, and somehow convince you to go there (via social engineering, DNS tampering, WiFi attacks, etc...), you'll approve a cert for the attacker's site and never see that warning again. Then you'll happily pass your credentials to that site. Very bad.

What you need is to get the fingerprint of the actual self-signed cert then compare it to what your browser is seeing (see this page for reference). But I'd guess that you will have a hard time getting any more information from the site's owners. So you have to decide if you are going to take the risk or not. One way to lower the risk a bit is to try to make the initial connection when you approve the cert happen over a more secure internet connection. For example, a hard-wired connection is likely harder to be altered by an attacker than a WiFi connection.

Depending on how the site is configured, you may be able to connect to it, approve the cert, login with your school id, then immediately change your school password (best if from another browser altogether). That will reduce the window of exposure if the connection is being snooped. Hopefully the site will allow you to stay logged in for subsequent accesses so you don't have to do this every time.

In the end, you'll have to get more information about the cert so that you can verify it by hand or cross your fingers and hope for the best.

4

You can trust to self-signed certificate if you validate certificate thumbprint via trusted channel - for example IT guy writes the thumbprint on the paper and you compare it with the value in the browser. If you trust to university, just get root ca certificate, validate it and import into system.

3

Yes you can.

And as surprising as this might look, today a certificate your verify yourself is something you should consider as the most trustworthy. A verified trust.

On the other hand, the trust you never verified toward magically recognized certificates embedded within your browser is of a much lower value. This is an unverified trust, a magic trust.

The warning of Chrome (or other browsers which would warn you in the same way) is legitimate and wants to protect you against self signed certificates from the jungle. But here you clearly are not in this jungle.

You don't have to ignore this legitimate warning of Chrome, you have to verify this certificate first and then make Chrome accept it.

  • 1
    But the OP does not discuss any actual manual verification and trusting any random self-signed cert has risks associated with it. – Neil Smithline Nov 3 '15 at 22:57
  • I tried to clearly avoid to bring the author to think:"ignore any warning of Chrome about not embedded certificates". Because you are right there are risks with such certificates. But the truth is there are also risks with embedded certificates. Overall, the best trust you can have in a presented certificate is the one you can and you do validate. – dan Nov 4 '15 at 6:58
0

Your University can get a free SSL certificate from https://www.startssl.com/ or you can use Mozilla Firefox with add-on like https://addons.mozilla.org/en-US/firefox/addon/certificate-patrol/

0

As long as you know that the site is supposed to be using a self signed certificate, which you do, and you are connecting over a known safe connection, it is safe to disregard the message - the warning message is because self-signed certificates usually mean that someone is MitM-ing the connection. However, by disregarding the message, you leave yourself vulnerable to a MitM attack by someone using a different certificate, if they really want to steal your credentials.

If you want to increase the security of the connection, you can save this certificate, so you won't get a security prompt when connecting using the correct certificate, but will do if someone tries to forge it. Assuming that you're using Chrome on Windows and that you trust the certificate publisher:

  • Connect to the server over a known secure connection, and accept the security prompt.
  • Click the padlock, connection, certificate information, then go to the Details tab.
  • Click copy to file, then follow the instructions in the wizard, saving it to somewhere memorable.
  • Close the certificate information dialog, then go to the Chrome settings page and click Manage Certificates.
  • Click Import, then load the file that you saved in the previous wizard.
  • Select "Place all certificates in the following store", and select "Trusted Root Certificate Authorities"
  • Click next, then read and accept the security prompts.
  • Restart Chrome

You should now be able to connect to the server without any security prompts as long as it uses that particular certificate.

  • Very interesting, I didn't know I could do this. However, Chrome does not import successfully the saved certificate. The problem is that from the Details tab I can only export to PKCS#7, while in Manage Certificates I can only import PKCS#12 files. When importing, Chrome asks for a password (which I never set) and if I leave the field blank it says that the import failed. – rubik Nov 3 '15 at 22:26
  • Weird - it worked for me using a test certificate exporting as DER encoded binary X.509 (.CER). I'm using Windows 10, though I would have expected it to be supported on previous versions of Windows too. – JackW Nov 3 '15 at 22:29
  • This is false As long as you know that the site is supposed to be using a self signed certificate, which you do, it is safe to disregard the message. There is no way to distinguish between the actual site's self-signed cert and an attacker's fake site using a self-signed cert. You need more information about the cert (eg: a fingerprint) to validate it. – Neil Smithline Nov 3 '15 at 23:00
  • I've updated the answer to make it clear that it's only safe if you're connecting over a known secure connection, which is the case (if you're connecting to some university connection over your own network, nobody who could use the info will be eavesdropping). Obviously checking the thumbprint is a good idea, but it's not essential IMO. – JackW Nov 4 '15 at 22:39
  • I guess a known safe connection means that you are confident that there is no MiTM and no DNS tampering. How exactly would you guarantee that without relying on SSL cert checks? – Neil Smithline Nov 5 '15 at 14:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.