In the osx keychain I was browsing certificates that my school forces me to trust and came upon an intermediate certificate authority that was signed by an untrusted user, I believe that would be me and was wondering what the certificate trust would default to when "no value specified" is what trusting ssl certificates is set to? I am also wondering what type of certificates this intermediate certificate could issue/sign?

The images below are of the intermediate root ca, as a side note this ca has already been used to sign certificates for x.509 basic policy and extensible authentication protocol(EAP) which makes sense since this is used to connect to wifi.

Listed below are some of the questions I had about how my school's wifi is set up and how I can protect myself

  1. Can the intermediate root ca which my school forces me to trust man in the middle my system by signing/issuing ssl certificates?
  2. can changing the certificate the intermediate CA certificate has issued trust to "Never trust" to everything but EAP and X.509 would help?
  3. Will revoking the intermediate CA's trust after the school wifi has given me an EAP certificate to connect to the wifi. allow me to both use school wifi and not have the school man in the middle my connection? and if so how I could go about doing this on IOS?
  4. Finally I was wondering what someone else would do in my position with mobile data prices in Toronto being so high?
  5. what the school was asking of me was a reasonable compromise between security and functionality? – keychain pt 1keychain pt 2

To be fair, I didn't use OS X much lately, but my suspicion is: Yes.

Not setting specific values for those usage types that supersede the system default is irrelevant, as the certificate is a CA.

With those options, you can disallow a specific usage for a specific certificate.

You can check if you are MITM'd by checking the CA of the certificate. Please also note that with PK-Pinning and HSTS, it's harder for SSL-Proxies to work without you easily noticing it, as long as the website is up for it.

There are browser plugins that check what other people get for a certificate for a given domain, further warning you of a MITM.

So the MITM when browsing can be mitigated, leaving other TLS-based services. There is DANE for that, but it must be supported by the client and the server and is not as wide spread as one would hope.

As far as "the school is forcing me to trust this CA" goes, you might also just import all leaf certificates that CA signed by hand and explicitly trust them to have access but not trust the CA. Thus, you know when something is wrong, but have to sometimes grant trust to new leaf certificates.

This would work for any other OS with a centralized and user-manageable trust store as well.

The weighing of that trade-off is ones personal opinion, while when aware you might just reduce the usage to non-critical applications or those secured by DANE.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.