0

I'm trying to configure mother's personal computers (Win10) for remote work with server in FL.

When I connect from her work laptop - using provided Cisco AnyConnect VPN 2.5 on Win7 - I can still access non-work related secure sites (such as mail.yahoo.com). However I get

"Your connection is not private"
Attackers might be trying to steal your info from [site] NET::ERR_CERT_AUTHORITY_INVALID
Subject: google.com
Issuer: [Company name] SubCA [name]
Exprires: [in the future]
PEM encoded chain: 4 chunks of ---BEGIN/END CERTIFICATE---

when doing the same from her personal computers (tried on Chrome/Edge, Norton/Avast combos).

What is the reason for this difference and how can I fix it?

  • Why is your company using such old AnyConnect software? It is like 7-10 yrs old. There are bugs in that software that have been fixed. Your company should be running AnyConnect 4.x. – user96721 Jan 12 '16 at 18:35
1

There is probably SSL interception done by your company, i.e. man in the middle of SSL connections to analyze for malware and data leakage. Please contact the works system administrator for details on how to configure your system to include the necessary certificates. Apart from that make sure that you are even allowed to connect private PCs to the work network.

See also Does a TLS interception proxy present the user's browser with the end server's certificate? and Is it possible for corporation to intercept and decrypt SSL/TLS traffic?

  • It could also be software installed by her employer that causes this issue. You could dig into the CA and see if you can identify whether that's associated with a known security software vendor, and then figure out whether it's your stack or hers that is the source of the issue. Another possibility is that her personal computers have differences in root CAs or other trust chain elements that are obscuring this issue. – Jesse K Jan 12 '16 at 16:16
  • Thanks - I'll have her contact the admin. They also allow VIP Access verification for general access but usage of their phone system requires VPN connection (at least on her work laptop). I added full details of the error message - that might clarify the issue/solution. @Jesse Could you guide me on digging into the CA - or should I stay away given my general lack of sophistication in this area? I get the same error on two different home machines. – A.S. Jan 12 '16 at 16:23
  • You've redacted the issuer above. We'll need to know the issuer in order to dig deeper. Generally speaking, an issuer is not considered sensitive information - how can you trust a cert if you don't know who said the cert is trustworthy? It would also be helpful to see the certificate hierarchy. You could do this at a command line using openssl s_client or more likely a screenshot of the certificate "details" tab in firefox or the "certification path" tab in IE. It would also be helpful if you could check this across browsers, as in some cases, browsers package different CA trusts. – Jesse K Jan 12 '16 at 16:42
  • @Jesse Company name = Company my mother works for = CN. Certification path (from Chrome): "CN Root CA -> CN Issuing CA1 -> CN SubCA [name] -> google.com" and certificate status for the first one is "not trusted as it's not in the Trusted Root CA store". – A.S. Jan 12 '16 at 16:52
  • I just read security.stackexchange.com/a/31036/96694 as I didn't know any details of VPN before. Why would the company direct all of the traffic through its server - not just work-related traffic? – A.S. Jan 12 '16 at 19:47

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.