Is there any ways to track which certificate is used for https connection in browsers?

Question

I encounter a strange SSL error messages in Mac laptop with https connections.

It only happens on some websites such as facebook, twitter with Firefox and Chrome and only happens at work. It is likely IT is doing sniffing the https traffic with firewall, since the same websites/browser/system works just fine at home internet connection.

Even stranger, with Safari those sites work just fine at work.

Is there anyway to get details on which certificates, CA were used by various browsers that authenticates the websites.

Answer 1

You can check certificate details if you follow bellow steps. I have shared the example using Firefox browser. However, Google Chrome is also quit same.

Answer 2

Yeah, that sounds like IT is man-in-the-middle'ing your HTTPS traffic. Although other things could cause that behaviour also.

I suspect IT has installed root certs into OSX for HTTPS inspection. The clue is that Safari will get its list of trusted root certs from the operating system, while Firefox (and Chrome?) have their own list embedded in the program.

To check, inspect the certificate offered by facebook, twitter, etc in the browser and see if they match.

Chrome

Source

Safari

source

Pay special attention to the Issuing and Root CAs to see if this looks like some sort of internal corporate CA. (I would show you the cert I see for comparison, but unfortunately, my company also uses an internal CA to do HTTPS inspection...)