4

I recently started a new consulting contract. The company I'm going the work for asked me to manually install a root certificate followed by a client certificate in order to connect to their work website. I'm on Mac and I use Chrome as my default browser. Looking in Chrome settings there's a link to manage certificates. Clicking it just opens the Mac Keychain Access app. Adding the root certificate there says

Company Name CA
Root certificate authority
Expires: Sunday, December 7, 2020 17:02:50 Pacific Standard Time
"Company Name CA" certificate is not trusted

Reading other Q&A this seems bad

Employer wants me to install root certificate to work remotely - privacy concerns?

Basically when I'm on their network they can read all my internet traffic. Not that I expect them to do that, it's a small non IT company. But still, I don't like the idea.

For now I'll setup a VM and install the root cert in that and use the VM solely to access their site.

My question though is: Is their some solution they could have used that would limit things so that their root cert only works with their domain / IP address rather than having it be a root cert and all the issues that entails?

Given that authentication happens with their client cert I'm guessing the root cert is only needed to validate the client cert. If so is their some other way they could have/should have generated a client cert that wouldn't require me installing a root cert?

| improve this question | |
  • Are they doing some form of inspection on all https traffic, or did they just install their own self-signed cert for their website? – Steve Sether Jun 19 '18 at 15:07
  • I doubt this particular company is inspecting traffic and of course their cert would only allow them to inspect traffic while they are in the middle (as in I'm visiting their office and on their wifi or VPN). That said it feels a little like someone asking for my bank account password and promising only to use it to put money in. My answer to them should be "no you can't have my bank account password". Similarly it feels like my answer here should be "No, I will not install your root cert on my personal machine". (hence the VM) but would love to know less heavy solution for them (or others). – gman Jun 19 '18 at 15:50
  • I'd agree with you if it's just their one website, and I wouldn't do it either. Installing a root cert means you not only trust the organization, but also trust their security to be extremely high. You should be able to click into the advanced settings when you hit a self-signed site and import just the website certificate into your browser. I was able to do this on badssl.com – Steve Sether Jun 19 '18 at 16:25
  • AFAIK Chrome on Mac doesn't have a way to import certs. It just defers to the OSes cert system. I see no option to import the cert in Chrome having clicked Advanced on the warning page. Switching to Firefox I found that I can create multiple profiles and firefox manages certs by profile so I can add the cert to just a single profile. Verified it doesn't exist in the other profiles. Switching profiles is more of a pain than Chrome but no VM required – gman Jun 20 '18 at 3:24
5

If you are using Chrome, you could generate an SPKI fingerprint from the company's public key:

openssl x509 -pubkey < "pubkey.pem" | openssl pkey -pubin -outform der | openssl dgst -sha256 -binary | base64 > "fingerprints.txt"

Then you can start Chrome from the command line with this flag:

--ignore-certificate-errors-spki-list=$(cat fingerprints.txt)

Then chrome will treat any certificates with that fingerprint as valid and won't show the red security error in the URL bar. This will only last for as long as Chrome has that command line flag.

| improve this answer | |
  • This seems to work fine for normal Chrome but not when used with --headless. – Yuri Feb 11 at 16:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.