2

I work at an organization that inspects all HTTPS traffic by injecting its own SSL certificates. It wasn't configured properly though, so Firefox always shows a "Your connection is not secure" error message. Sites that use HSTS do not allow me to see them at all.

This is a problem because I am a developer and I need to download files from the Internet. wget becomes wget --no-check-certificate, git clone becomes git -c http.sslVerify=false clone, and so forth. This is more than an inconvenience -- it is a security hazard, and it makes it impossible to run certain scripts that do not provide an option for accepting insecure certificates (such as running get-pip.py for installing the Python package manager).

I have looked under the little padlock in Firefox and I don't see a root certificate for me.

Is there any way for me to accept these certificates globally? I have root on my machine.

4

There is no way to accept these certificates globally because different tools use different trust stores. wget on Linux uses the certificates at /etc/ssl/certs, Firefox comes with its own CA store, with curl it is depending on the TLS library, Python might have its own store depending on the package used, Java has its own etc.

  • How would I get the certificate at all though? I wouldn't mind adding it to a few select places -- especially if it means getting all the software that runs OpenSSL (happyassassin.net/2015/01/12/…). – szxk Jun 25 '16 at 1:14
  • @szxk contact the IT department that owns the proxy – Neil Smithline Jun 25 '16 at 3:42
  • @szxk: you can extract the proxy CA from the browser (look at the certificate chain and export the appropriate certificate). But in this case you don't know if this is the intended certificate or an attack. So you better follow the recommendation from Neil Smithline and get the proxy CA from your system administrator. – Steffen Ullrich Jun 25 '16 at 4:54
  • On Intranet pages, I am able to extract a CA certificate. On public pages, the certificate is issued by a different provider (also tagged to an internal email), and the highest-level certificate I can extract is specific to the site I am on. When I try to reimport that into the browser as a trusted CA ceritficate, it says that it is not a CA certificate. Is it possible for the proxy administrator to hide the certificate itself from download? – szxk Jun 25 '16 at 5:04
  • @szxk: the highest level certificate is the certificate for the site itself (leaf certificate) which is not a CA certificate. You have to use the issuer certificate for the site certificate instead. – Steffen Ullrich Jun 25 '16 at 5:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.