4

So my company has just started issuing their own SSL certificates, so HTTPS sites now show as being secure, but if you check the certificate used the root CA is us, not whoever the site used.

This got me thinking, if I was on a public network somewhere, could they issue their own certificate making it appear trusted, and therefore giving me a green padlock on my bank site for example?

After typing this, I believe I may know the answer to my own question... does it appear trusted because of a group policy telling the PC to trust the cert? So mobile phones (or devices that aren't joined to AD) would say every HTTPS site is insecure?

If this were to happen on a public network, how would you ensure safety? Would a VPN still protect you, or would they be able to intercept that too?

  • What's your exact question? – Deer Hunter Jan 31 '16 at 23:09
  • Do you mean if your company was intercepting your traffic on a public network, or if some other person/company was? – immibis Feb 1 '16 at 0:46
2

This got me thinking, if I was on a public network somewhere, could they issue their own certificate making it appear trusted, and therefore giving me a green padlock on my bank site for example?

Yes.

does it appear trusted because of a group policy telling the PC to trust the cert?

Yes. (Or some other mechanism telling the PC to trust the cert. By default it won't be trusted)

So mobile phones (or devices that aren't joined to AD) would say every HTTPS site is insecure?

Yes.

If this were to happen on a public network, how would you ensure safety?

If you don't want your company to be able to intercept your traffic, don't use their equipment, and don't install their root certificate on your equipment.

Would a VPN still protect you, or would they be able to intercept that too?

Depends on the VPN.

How can a public network install a cert on your computer?

It can't, unless it uses some kind of exploit (similar to the way viruses propagate). That is much less likely to happen now than it was in the past.

How would a VPN protect against a rogue cert once it's installed?

By not trusting the certificate. Nothing forces a program to trust all installed certificates.

  • How can a public network install a cert on your computer? How would a VPN protect against a rogue cert once it's installed? – Neil Smithline Feb 1 '16 at 3:52
  • @NeilSmithline Answers added – immibis Feb 1 '16 at 4:31
2

It's not really related to Active Directory or Group Policy. That's just one way to do it.

If someone can install their own root cert in your trusted store(s) then they can issue fake certs and everything thing looks legit. See Charles Proxy.

One legit use for this is to allow tools like Snort to monitor encrypted traffic on a network.

Some applications pin their cert and don't use the trusted store (Chrome does this with Google's certs).

BYOD or expect that your company is decrypting your traffic.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.