1

So I'm at work today and I'm having all kinds of issues getting into secure sites that I need to do my job. So I go to portal.azure.com and I find out that the certificate for the site isn't issued by Microsoft (as it is outside work) but rather by my internal CA and issued to portal.azure.com.

This is true of a lot of sites on the internet -- the certificate isn't issued by the site, but rather by our organization as what I'd think is a man in the middle cert. I'm not sure why this is being done, but it is also causing a huge amount of problems with legitimate sites because they won't load certain information while I'm using them at work. At home, they all load fine.

Appreciate if any of you can shed some light on why this might be happening, and what the purposes are. Does it cause any insecurity by doing this? Appreciate any comments or feedback you can provide.

1
  • Think of it this way. You are passing written letters to someone. And the person it is intended for comes and picks it up. You can be mostly sure that no one has read it except you and that person. Now lets put a man in the middle. You trust this unknown man to exchange that letter for you. You now have no idea if that man reads that letter before giving it to your buddy or visa versa if he brings letters back to you.
    – Bacon Brad
    Dec 1, 2015 at 23:34

1 Answer 1

2

In the case of a corporate network this is called an SSL Proxy. These SSL proxies intercept certificates and should be transparent to end users. It sounds like yours might have some configuration issues. Bluecoat probably has one of the most popular SSL proxies but it can be done with Microsoft ForeFront Threat Management Gateway.

The most common stated reason why SSL Proxies are used is to have the ability to inspect corporate traffic for audit, compliance, and/or data loss prevention purposes. There is plenty of debate on the legality of doing this but in the U.S. - as far as I know - it is legal as long as it is disclosed. (i.e. Banner pop-up stating that the company has the right to monitor, etc.)

2
  • Can SSL proxies be used to intercept passwords and the like?
    – Shyatic
    Dec 3, 2015 at 0:40
  • If the architecture (eg. authentication) depends on TLS to provide confidentiality for the traffic then yes, interception is possible. This is one reason why passwords for example should be hashed on the client side (when technically possible) to prevent man-in-the-middle attack, vulnerabilities in the TLS protocol, or intentional interception like SSL proxies.
    – user79331
    Dec 3, 2015 at 11:13

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .