So my company has just started issuing their own SSL certificates, so HTTPS sites now show as being secure, but if you check the certificate used the root CA is us, not whoever the site used.
This got me thinking, if I was on a public network somewhere, could they issue their own certificate making it appear trusted, and therefore giving me a green padlock on my bank site for example?
After typing this, I believe I may know the answer to my own question... does it appear trusted because of a group policy telling the PC to trust the cert? So mobile phones (or devices that aren't joined to AD) would say every HTTPS site is insecure?
If this were to happen on a public network, how would you ensure safety? Would a VPN still protect you, or would they be able to intercept that too?