3

My new employer wants me to install a root certificate on my computer as trusted in order to work remotely. I believe it is to use Cisco AnyConnect vpn. I don't really have a clear understanding of how they work so I wanted to come here to get some advice. It seems like they could monitor my web traffic by having me install this root certificate is that correct? If they could gather information on my browsing habits or what I'm doing in my spare time I would rather get a new computer dedicated solely for work.

I'm just not sure if a trusted root certificate can be abused in this way.

Edit: This is on my own personal home computer, not a work computer. I want to ensure my employer cannot view my personal files or my internet browsing habits.

According to the instructions, they want me to install a trusted root certificate from them (the employer). They say I may have warnings when I am installing it but to just disregard it.

From what I gather it seems like the root certificate is to access the vpn. My apologies if this doesn't make sense, I don't know much about it myself and it was very difficult finding information on google to determine if trusted root certificates can be exploited or whether it is ok to install it on your personal computer.

The root certificate information appears to be associated with the vpn information in the manual so I assumed it was required to authorize you to access the company website/servers through AnyConnect.

My goal is that when I am not connected to AnyConnect, my employer can't see what websites I visit. I would also not want them to see what files I have on my PC at any time (whether I'm connected to AnyConnect or not). Basically I don't have a problem with my employer monitoring what websites I go to when I'm using anyconnect, but in my private time I don't want them having access to that because it's private.

Thank you for the advice on getting a new machine. Hopefully their monitoring only extends to the PC with the trusted certificate and not the wireless network it is on.

Edit 2: Thank you for the answers everyone. From what I gather from all the combined answers is that when connected to the vpn the company can view my internet traffic. When I'm not connected to the vpn, they generally do not, unless they wanted to be sneaky (unlikely but a possibility nonetheless). I think that in this case it would seem the safest option is to purchase a separate work pc. Thank you for all of your help!

Improve this question
  • Please edit and add to your question: is this your private computer or a company-supplied one? Do you plan to do private stuff on that computer as well? These questions are not relevant to an explanation of how it works, but they are to the risk assessment. – user13695 Oct 18 '17 at 14:10
  • Are you installing a root certificate or are you installing a client certificate to authenticate to the vpn? – AndrolGenhald Oct 18 '17 at 14:22
  • The OP states they are installing a root certificate – ISMSDEV Oct 18 '17 at 14:25
  • @ISMSDEV They say they're installing a root certificate, but they also state they believe it is to use a vpn, so perhaps they've misunderstood something? It's possible it's a root cert for internal websites for the employer, but OP says they don't have a clear understanding so I think it's best to clarify. – AndrolGenhald Oct 18 '17 at 14:31
  • Totally agree, worth checking. – ISMSDEV Oct 18 '17 at 14:37
4

Installing a root certificate on your machine will make your machine implicitly trust certificates signed by that root CA. If you don't understand what that means, you should read up on the basics of certificates and TLS.

It seems like they could monitor my web traffic by having me install this root certificate is that correct?

When you communicate with their VPN, they will be able to decrypt that traffic. That's kind of the whole point. Otherwise you will not be able to communicate with them. If you are going through their VPN out to the internet your traffic will likely be going through a proxy. Because you trust their root certificate you are treating them as a certificate authority (CA), that proxy can issue certificates for any domain you are connecting with. So you will see a green lock or whatnot on your browser but if you were to look at the certificate chain it would show the company as the authority. For example, when I am at work, when I look at the certificate chain for this site, it has been issued by my company's CA. This is really a legitimate thing for the company to do. You are on their network and they have every reason to need see what you are doing on it.

When you are not on the VPN, you will still trust their CA but you will not be forced through their proxy to the internet. So when you go to google, you will see that their cert is issued by some other CA that you trust and not the company's CA. The company cannot decrypt this traffic. However, if they really wanted to, it's possible to set up a fake site using their certificates and through various means trick you into thinking it was really google (for example) and see what you are searching for. Unless this is a shady company, I would think such a scenario would be unlikely.

If they have you install special software on this machine, however, they could monitor all your activities and/or remotely control your computer.

Improve this answer
  • Thanks for your response. I don't mind if they see what I am browsing when im connected to their vpn. I just didn't understand if after I shut down anyconnect if they could then keep monitoring my traffic - which is obviously not something I want. Your right, I tried to research certificates and I know some about computers, but a lot of it was over my head. Edit: To be more specific, what I want to make sure is that when I'm not connected with AnyConnect that the company does not see what websites I'm visiting or can view files on my pc. – restoraider Oct 18 '17 at 14:49
  • A certificate is not software and cannot 'see' anything. What you are doing by accepting (trusting) their certificate, you are saying telling your machine that the company is a trusted source for verifying identities. This company can only decrypt traffic if they have the private keys being used (which will always be the case when you are using their internet proxy.) Adding their cert doesn't allow them to decrypt anything, by itself. – JimmyJames Oct 18 '17 at 16:23
  • @JimmyJames Could you please explain how is the "off VPN fake site using their certificate scenario" possible? My understanding is that when user is off VPN, traffic between say user home computer and (ex.) Google does not go through company at all, so user would need to explicitly access the fake site which would then be trusted if the cert is installed...? – evilmandarine Nov 9 '18 at 11:07
  • @supafly Once you've installed a root CA certification on your machine, it will trust any cert that is signed by that CA. That trust is configured on your machine, it has nothing to do with your VPN connection. In order to 'fake Google' though, they would also need to trick you into connecting to a server they control which then presents the "google" certificate signed by them. For example: they could, while configuring your machine, mess with your DNS setting to use a server they control even when you are not on their network. – JimmyJames Nov 9 '18 at 18:27
0

Yes they could 'see into' your encrypted traffic by using certificates created by their root certificate. They could also filter or tamper with any traffic. It's likely they want this to be installed for their firewall/AV to be able to inspect the traffic to make sure its safe and within policy.

Once connected to their network they could do alsorts of things to your machine. You also risk breaking any corporate policies by doing things on your laptop that they may not approve of. You are wise to look at using a different machine.

Improve this answer
  • Thanks. Yes it seems like there is a mix between whether a company would go through and actually do this or not, but I believe you are right, better to do it on a separate PC and play it safe. – restoraider Oct 18 '17 at 14:50
0

Your employer asked you to install a root certificate in order to connect to the company, and likely your internet traffic is routed trough their proxy as long as the vpn is connected. The proxies made by Bluecoat and Ironport are able to inspect the traffic (for malware etc.) You can inspect the root certificate and verify the 'issuer', this might show the brand of such proxy. Your employer's system admin can sign certificates of any website or mail server, and snoop on your traffic while you use the vpn. Encrypt your email with pgp to avoid snooping.

Off-vpn you might be lured to fake sites by the firm. To avoid this risk you could use Firefox without their root cert. Firefox manages root certificates independent from the operating system. The risk of your employer signing other websites' certificates touch the political side of encryption, your legal system, and the goals/purpose of your employer.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.