What is the best practice when corporate network is overwriting SSL certificates?

Question

The company I work at has started to overwrite SSL certificates with their own self issued one so that they can monitor traffic to the internet more closely. They also installed the corresponding CA to the certificate store. When this occurred various applications stopped working since the certificate that is being sent back from the network is not a trusted CA for that program.

Why do some programs (like Chrome and IE) work, and some (Firefox, NPM, GIT) don't?

Is this the right way to do all this?

I am wondering if telling every program to use this CA is the way to handle this problem. Seems very annoying to have to let every program know that a CA is ok.

The main question is:

Given that a corporation is overriding SSL certificates, what is the best way to get things working again when they do not rely on the OS level Certificate store?

• Would it be to tell IT not to override SSL certificates to these services/site?
• Would it be to use a proxy?
• Would it be to do what I am doing and tell every program to allow the overridden SSL certificate?

So this is what I have done to get various programs working:

To get the Certificate so that you can import to other programs:    
 1. Open Certificates by running ”certmgr.msc” in cmd
 2. Go to “Trusted Root Certification Authorities” > “Certificates”
 3. Right click internet > Export
 4. Select “Base-64 encoded X.509 (.CER)”
 5. Save to c:/temp/internet.cer

To get Firefox working:    
 1. In the address bar, enter “about:preferences#privacy”
 2. “View Certificates” > “Authorities” > “Import”
 3. Select “c:/temp/internet.cer”
 4. Select the trust type of “Trust this CA to identify websites”, then click “Ok”

To get GIT working:    
 1. Open Cmd as admin
 2. git config --global http.sslCAInfo “c:/temp/internet.cer”
Do not run git config http.sslVerify "false"

To get NPM working:    
 1. Open Cmd as admin
 2. npm config set cafile “c:/temp/internet.cer”
Do not run npm config set strict-ssl false

To get Bower working:    
 1. Open Cmd as admin 
 2. cd %UserProfile%
 3. echo {"ca": "C:\\temp\\internet.cer","strict-ssl":false} > .bowerrc

Answer 1

So, you work at a corporation that appears to have a significant enough corporate network/security department to have put in MiTM security scanning.

Assuming your "best practice" on how to get your applications working includes keeping your job, you should start by contact your network/security department through the normal channels and ask if they have already worked out a corporate answer to your question!!!

You can, of course, provide the workarounds you have used to, I assume, use the tools that your supervisor/manager has approved for you to use to perform your job duties.

In general, however, you're using tools made by different organizations, many of which do not trust each other (particularly the open source tools and Microsoft), and many of which are using entirely different toolchains (particularly the open source tools and Microsoft). Why would you expect everything everyone writes to use the One True Certificate Store?

Best practice is going to be one of three things:

• The responsible Corporate IT department(s) already solved your issue with the approved tools, and yours are on the list. They'll take care of you.
  • Eventually.
  • With the correct paperwork.
• The responsible Corporate IT department(s) have forbidden/not approved (and not allowed) at least one of your tools.
  • Remove it immediately
  • Find an approved replacement
  • Or get some software approved
  • Or find another job
• The responsible Corporate IT department(s) aren't forbidding your tools, but they don't support them either
  • Workarounds are your problem for each.
  • If you have teammates that use them, package up a batch file or executable that makes as many of the config updates as possible in a consistent, automated way.
  • Or see if the responsible Corporate IT department(s) would be interested in assisting with this, since it's in their interests to have similar configurations for groups, not a bazillion individual configs.

Answer 2

Operating systems have root certificate stores to attempt to centralize this. The problem is several applications choose not to trust it.

Firefox chooses by default not to trust the store. You can make it do so by setting security.enterprise_roots.enabled to true. There are ways to roll this out to all users simultaneously including via group policy to deploy the necessary locked config files.

Git, bower and npm suffer similar issues except none to my knowledge have methods to make them trust the root store. You need to modify or replace the trusted certificate stores for each application - this should be possible via normal domain management tools.

Answer 3

Honest answer - talk to your team that manages the SSL inspection and request exemptions made for all the development tools/sites you mentioned. Back this up with a business case that if an exemption is not made productivity will decrease and the risk profile will increase as they will force users to look for ways to ignore SSL. If they say no - log time lost due to work arounds and pass it up the chain.

You cannot use a proxy within your network to get through the SSL inspection if its your gateway (well you can, but its not worth the effort) plus dont you're trying to get around security controls and its no doubt against your companies policy.

Other things to note:

• Java has a seperate trust store to Windows OS so certificates will need to be added here for applications using TLS
• Linux will not update with windows GPO if that is used within your corporate so will need to be done manually
• As mentioned already not all browsers use the under lying OS certificate store
• Applications written to used across all environments will no leverage the windows certificate store and instead use an agnostic method - which is what you are finding with git and npm

Answer 4

Breaking SSL is probably done on a proxy like BlueCoat's. When I was managing it, administrators had to pretty much work and experiment to get everything to work individually through whitelisting user agents, whitelisting entire domains (Microsoft's for example), bypassing rules, etc. It takes a lot of effort, skill, and time to sometimes get an app to work perfectly over SSL intercept. If your network security admins are good at their job, they should use a combination of proxy configuration and things like GPO to minimize end user disruption. I'd personally find it incredibly bizarre if they decided to intercept SSL, and left a lot of things completely broken for employees to figure out themselves.