0

I'm trying to configure mother's personal computers (Win10) for remote work with server in FL.

When I connect from her work laptop - using provided Cisco AnyConnect VPN 2.5 on Win7 - I can still access non-work related secure sites (such as mail.yahoo.com). However I get

"Your connection is not private"
Attackers might be trying to steal your info from [site] NET::ERR_CERT_AUTHORITY_INVALID
Subject: google.com
Issuer: [Company name] SubCA [name]
Exprires: [in the future]
PEM encoded chain: 4 chunks of ---BEGIN/END CERTIFICATE---

when doing the same from her personal computers (tried on Chrome/Edge, Norton/Avast combos).

What is the reason for this difference and how can I fix it?

Improve this question
1
  • Why is your company using such old AnyConnect software? It is like 7-10 yrs old. There are bugs in that software that have been fixed. Your company should be running AnyConnect 4.x.
    – user96721
    Jan 12, 2016 at 18:35

2 Answers 2

Reset to default
1

There is probably SSL interception done by your company, i.e. man in the middle of SSL connections to analyze for malware and data leakage. Please contact the works system administrator for details on how to configure your system to include the necessary certificates. Apart from that make sure that you are even allowed to connect private PCs to the work network.

See also Does a TLS interception proxy present the user's browser with the end server's certificate? and Is it possible for corporation to intercept and decrypt SSL/TLS traffic?

Improve this answer
13
  • It could also be software installed by her employer that causes this issue. You could dig into the CA and see if you can identify whether that's associated with a known security software vendor, and then figure out whether it's your stack or hers that is the source of the issue. Another possibility is that her personal computers have differences in root CAs or other trust chain elements that are obscuring this issue.
    – Jesse K
    Jan 12, 2016 at 16:16
  • Thanks - I'll have her contact the admin. They also allow VIP Access verification for general access but usage of their phone system requires VPN connection (at least on her work laptop). I added full details of the error message - that might clarify the issue/solution. @Jesse Could you guide me on digging into the CA - or should I stay away given my general lack of sophistication in this area? I get the same error on two different home machines.
    – A.S.
    Jan 12, 2016 at 16:23
  • You've redacted the issuer above. We'll need to know the issuer in order to dig deeper. Generally speaking, an issuer is not considered sensitive information - how can you trust a cert if you don't know who said the cert is trustworthy? It would also be helpful to see the certificate hierarchy. You could do this at a command line using openssl s_client or more likely a screenshot of the certificate "details" tab in firefox or the "certification path" tab in IE. It would also be helpful if you could check this across browsers, as in some cases, browsers package different CA trusts.
    – Jesse K
    Jan 12, 2016 at 16:42
  • @Jesse Company name = Company my mother works for = CN. Certification path (from Chrome): "CN Root CA -> CN Issuing CA1 -> CN SubCA [name] -> google.com" and certificate status for the first one is "not trusted as it's not in the Trusted Root CA store".
    – A.S.
    Jan 12, 2016 at 16:52
  • I just read security.stackexchange.com/a/31036/96694 as I didn't know any details of VPN before. Why would the company direct all of the traffic through its server - not just work-related traffic?
    – A.S.
    Jan 12, 2016 at 19:47
0

For me I just had to turn off the Proxy (Under Network and Internet) on Windows 10 and it solved the problem. Also I unchecked Internet Protocol Version 6 (TCP/IPv6) under Network Connections.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .