1

I try to connect to a Wi-Fi network, Eduroam, using my new Android device. It asks me to provide the CA certificate and warns that otherwise my connection would not be private.

No certificate specified. Your connection will not be private.

On my previous device, I did not have such warning message. The IT administrator says it's OK not to provide the certificate, but I'm not so sure about it. He said that our organization does not have it.

What threats am I exposed to, if I use this network without CA certificate?
Does it cost for an organization to get it?

Android your connection will not be private

  • Is there any other solution other than using a vpn? – Alfred Jul 1 at 21:48
  • I have this same problem at my university. They actually do have a certificate, but Android 8+ doesn't load it automatically. Windows 10 will, and you can even verify its thumbprint. I worked around this problem by transferring the certificate that was loaded on Windows 10 to my Android (you have to get onto another wifi or data network of course). Not easy, but it worked. – Fuhrmanator Aug 24 at 23:32
  • This is suprisingly very common advice – Fuhrmanator Aug 24 at 23:39
2

Without a valid certificate in place, there is effectively no way to verify that the owner of that network is who they say they are.

Secondly, these certificates are used to encrypt the client device with the destination so you could be vulnerable to a MITM attack here.

The organisation does need to pay for a registrant authority to distribute a certificate - in my experience a lot of very small organisaitons who host public WiFi see this as a needless cost.

Your usability of the network won't be affected but I would not connect to an unverified, public WiFi as it's trivial to intercept any data flowing between you and the AP: it's the digital equivilent of not locking a public bathroom door.

  • 2
    Wouldn't the wireless communication still be encrypted using WPA2? I thought the CA cert requirement was to validate the credentials at this step. – Allen Howard Sep 11 '18 at 13:37
  • 1
    The initial handshake of WPA2 will require a check on the certificate. If there isn't one, you can bypass this manually and agree to connect, however you may then be connecting to a rogue AP (albeit, which may be using WPA2 but your destination's not what you expected). – Doomgoose Sep 11 '18 at 15:03
  • 2
    One logical step I think you're missing is that a rogue AP can perform no checking on the provided username/password and just say "Seems right ;)" and let you connect, after which they start snooping on your traffic and/or trying to crack the password for the real network. – Riking Sep 11 '18 at 16:14
  • 1
    Yeah, I was thinking more just the encryption of the signal, not the data afterwards, but it is a very valid concern. – Allen Howard Sep 11 '18 at 17:26
  • I assume using VPN on such network reduces the risk of my data being stolen, because a potential MITM attacker would at most see that I am connecting to my VPN address? – ZygD Sep 19 '18 at 16:45

Not the answer you're looking for? Browse other questions tagged or ask your own question.