My (bring your own device) school has recently implemented TLS interception for search engines and Youtube. We all installed a root certificate as a "Trusted Root CA."
Taking a look at the fake google certificate used for interception, it includes *.google.com, *.android.com, and every other google domain as alternate names.
The crux of the issue, however, is that every certificate in the district seems to use the same private key. I ran these commands:
diff -s <(openssl x509 -pubkey -noout -in root.crt) <(openssl x509 -pubkey -noout -in fake-google-signed-with-root.crt) diff -s <(openssl x509 -pubkey -noout -in root.crt) <(openssl x509 -pubkey -noout -in fake-google-signed-with-root-2.crt)
and for both commands got "Files /dev/fd/63 and /dev/fd/62 are identical" as the output.
Does this mean the root certificate and the signed google certificate contain the same private key? Should each school in the district be using the same fake google certificate? What are the security implications of this?