3

I try to connect to a Wi-Fi network, Eduroam, using my new Android device. It asks me to provide the CA certificate and warns that otherwise my connection would not be private.

No certificate specified. Your connection will not be private.

On my previous device, I did not have such warning message. The IT administrator says it's OK not to provide the certificate, but I'm not so sure about it. He said that our organization does not have it.

What threats am I exposed to, if I use this network without CA certificate?
Does it cost for an organization to get it?

Android your connection will not be private

Improve this question
4
  • Is there any other solution other than using a vpn?
    – Alfred
    Jul 1, 2019 at 21:48
  • I have this same problem at my university. They actually do have a certificate, but Android 8+ doesn't load it automatically. Windows 10 will, and you can even verify its thumbprint. I worked around this problem by transferring the certificate that was loaded on Windows 10 to my Android (you have to get onto another wifi or data network of course). Not easy, but it worked.
    – Fuhrmanator
    Aug 24, 2019 at 23:32
  • Related: android.stackexchange.com/questions/197261/…
    – Fuhrmanator
    Aug 24, 2019 at 23:36
  • This is suprisingly very common advice
    – Fuhrmanator
    Aug 24, 2019 at 23:39

1 Answer 1

Reset to default
3

Without a valid certificate in place, there is effectively no way to verify that the owner of that network is who they say they are.

Secondly, these certificates are used to encrypt the client device with the destination so you could be vulnerable to a MITM attack here.

The organisation does need to pay for a registrant authority to distribute a certificate - in my experience a lot of very small organisaitons who host public WiFi see this as a needless cost.

Your usability of the network won't be affected but I would not connect to an unverified, public WiFi as it's trivial to intercept any data flowing between you and the AP: it's the digital equivilent of not locking a public bathroom door.

Improve this answer
5
  • 2
    Wouldn't the wireless communication still be encrypted using WPA2? I thought the CA cert requirement was to validate the credentials at this step.
    – Allen Howard
    Sep 11, 2018 at 13:37
  • 1
    The initial handshake of WPA2 will require a check on the certificate. If there isn't one, you can bypass this manually and agree to connect, however you may then be connecting to a rogue AP (albeit, which may be using WPA2 but your destination's not what you expected).
    – Doomgoose
    Sep 11, 2018 at 15:03
  • 2
    One logical step I think you're missing is that a rogue AP can perform no checking on the provided username/password and just say "Seems right ;)" and let you connect, after which they start snooping on your traffic and/or trying to crack the password for the real network.
    – Riking
    Sep 11, 2018 at 16:14
  • 1
    Yeah, I was thinking more just the encryption of the signal, not the data afterwards, but it is a very valid concern.
    – Allen Howard
    Sep 11, 2018 at 17:26
  • I assume using VPN on such network reduces the risk of my data being stolen, because a potential MITM attacker would at most see that I am connecting to my VPN address?
    – ZygD
    Sep 19, 2018 at 16:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .