0

Why I get "Invalid certificate" error when I use school network? This error usually appears on sites about programming, Linux and about security, privacy or anonymity.

Sometimes I receive error "Connection refused" when I try access to these websites. Am I victim of Man-In-The-Middle attack?

5
  • 3
    We don't have enough information to tell what's going on. One possible scenario is that your school in doing a MitM, other possible scenario is that you actually tried to enter a site while it's certificate was expired or revoked. Even another scenario is that the computer you use in the school network does not trust the CA that issued the certificate. To clarify you should view the page certificate and manually check it
    – Mr. E
    Apr 25, 2018 at 17:38
  • It occurs on random pages.
    – user164059
    Apr 25, 2018 at 17:40
  • 2
    Please edit your question to clarify instead of replying in comments. Also, the text from the picture would be more helpful than the picture. Apr 25, 2018 at 19:10
  • 3
    Please do not screenshot your entire desktop when all you need is a single window's content
    – schroeder
    Apr 26, 2018 at 8:28
  • You need to collect and show at least some indicative information, e.g cert subject info, netstat trace. It will be more conclusive if you learn to capture the traffics using Pcap /wireshark and extract data to analyze them.
    – mootmoot
    Apr 26, 2018 at 14:09

1 Answer 1

1

You are not victim of an attack, it's because your school employs a SSL Proxy.

In this kind of proxy, every connection (even SSL) is terminated at the proxy, inspected for malware, and if all is fine, re-encrypted with its own certificate and sent to your computer. Usually, the proxy have a certificate authority installed and can create certificates for every single site you access, and this authority is configured as trusted on all computers of the organization.

In your school, they didn't added the certification authority certificate as trusted on the computer you are using.

7
  • 3
    What you described is a man in the middle attack. Especially if it is not disclosed to the students. Apr 25, 2018 at 17:39
  • 5
    This is exactly a Man-in-the-Middle attack, whether you trust the entity performing the attack doesn't make it different
    – Mr. E
    Apr 25, 2018 at 17:40
  • It is not an attack IF this is the expected way the network works (and it is). Unless you consider an attack when your antivirus intercept a malicious program you downloaded and deletes it.
    – ThoriumBR
    Apr 25, 2018 at 19:35
  • You're assuming they're running a proxy. While you may be correct, I would modify this to reflect "Your school MAY be running an SSL proxy consult with faculty." Otherwise someone else may take this as the holy grail and run with it whenever they get the error. As for your secondary comment, make little sense. (AV/interception... Irrelevant)
    – munkeyoto
    Apr 25, 2018 at 20:53
  • @ThoriumBR If the user does not expect this behavior it's not "the expected way the network works". Even in the case that it was clarified and expected that the proxy makes a new certificate for each page I wouldn't call "expected" that the new CA is not trusted by the computers within the organization. Browser warnings shouldn't be discarded without a good reason, and just SUPPOSING that there is a SSL proxy without actual proof of who owns the signing CA is not good enough
    – Mr. E
    Apr 26, 2018 at 1:50

You must log in to answer this question.