This question already has an answer here:
I have reason to believe that my employer may be performing HTTPS man-in-the-middle attacks on company-issued work laptops, as Java's SSL Certificate lists my employer as the Certificate Authority.
When launched, the Java Platform (
jp2launcher.exe) displays a warning that the connection to
https://javadl-esd-secure.oracle.com:443 is untrusted, and that "The certificate is not valid and cannot be used to verify the identity of this website."
Clicking More Information opens a window stating that "The digital signature for this application was generated with a certificate from a trusted certificate authority, but we are unable to ensure that it was not revoked by that authority." A link to the Java help page for self-signed certificates is also included.
I cannot share the full certificate details, as doing so would reveal the identity of my employer. However, I can confirm that Java lists my employer as the Certificate Authority.
Is my employer running man-in-the-middle HTTPS attacks? If so, should I be concerned about potential security exploits?
I've read that HTTPS scanning can lead to weakened browser security, such as when Kaspersky exposed users to MITM attacks earlier this year. If company-run HTTPS scanning is common practice, couldn't it fall victim to the same previously mentioned security issues?