My employer has set up what they're calling "SSL decryption" for Internet access from within the company. I believe this is provided by an f5 device. They have installed a trusted root certificate on all corporate devices, and are using this to terminate outgoing https, making their own https connection to the external server, intercepting all data in plaintext, and re-encrypting it using a fake certificate signed by their replacement root certificate. So, man-in-the-middling everything.
I can see that this interception is taking place by viewing the certification path in my browser, I get something like:
+- Acme Corporation Root CA | +--+- * | +--+- www.letsencrypt.org
The above is true for both Internet Explorer 11 and Chrome 65. However, when I try Firefox 59 I see the following certification path:
+- DST Root CA X3 | +--+- Let's Encrypt Authority X3 | +--+- www.letsencrypt.org
What I understand from this is that the Firefox connection has not been intercepted and decrypted. (If I've reached the wrong conclusion here, then that would be useful to know.)
Firefox provides under Technical Details the following info:
Connection Encrypted (TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384, 256 bit keys, TLS 1.2)
I can't find a way to see which version of TLS is used by IE and Chrome.
Firefox does not show any installed corporate root certificate in its list of trusted certificates (as it doesn't use the Windows certificate store). Also, the
security.enterprise_roots.enabled option is
My question is, why and how does Firefox avoid this? Is Firefox lying to me and the connection actually is being intercepted somehow? Is it using a different version of TLS or different cipher suite that the f5 device can't handle?
Note that I have read How can end-users detect malicious attempts at SSL spoofing when the network already has an authorized SSL proxy? which describes a similar situation but wasn't really enlightening. I have also seen the Certificate Patrol addon but that isn't compatible with Firefox Quantum. (Is there a replacement that does work with modern Firefox?)