Employer Self Signed Root Certificate

Question

I don't have knowledge into programming/cybersecurity so I stumbled upon this site and figured I'd ask a quick question. I worked for about 3 years at company and left as of last week. I don't know how I remembered this, but I recall installing a "root certificate" on my phone and laptop. Long story short, I was able to find it (mac laptop) and it says "self-signed root certificate". I may be wrong, but I believe this was installed when either connecting to their internet or going onto the company email server.

I don't know if i need to put the details of the certificate, but long story short. Does this mean that all network traffic (when not connected to the company wifi) was being monitored? I went ahead and deleted the certificate.

I apologize if this isn't the place to post this question, or if I'm just completely wrong in my thinking. Thanks in advance

Answer 1

Does this mean that all network traffic (when not connected to the company wifi) was being monitored?

The traffic was likely monitored while you were in the company since your traffic there went over the corporate firewall. While you are outside the company your traffic usually goes not over this corporate firewall (unless you use a VPN into the company) so they could not monitor you.

In theory the company could use this certificate if they manage to control your traffic. This could be for example the case if you use the companies DNS server or if they explicitly attack your network. But, while possible, this is unlikely as long as the company you work for has proper ethics and has no real reason to monitor you after you've left the company.

In any case it is good that you've deleted the companies root certificate. And if you did not get any errors while visiting HTTPS site after you've deleted the certificate it is very likely that they don't monitor you now and probably did not monitor you before after you've left the company.