1

When connecting to a resource with SSL, I know that the certificates can be validated by the client to make sure the connection is secure.

I recently run into SSL problems at work, when connected to my company's network (only when using specific WLAN endpoint). I did not face any issues when using the web browser, but when I made connections with curl or java I got errors like "SSL certificate problem: self signed certificate in certificate chain" or "PKIX path building failed; unable to find valid certification path to requested target”. I had a look at the certificate chain in the browser and saw that the entire certificate chain of the website was replaced with certificates of my company. However, this was only the case for certain websites, other websites like google or amazon were still loaded with the correct certificates.

So now I have a couple of questions for you. How is it possible to change all the certificates? Why does my browser not complain about this? Does someone know why this is happening only for specific websites? I work at a very large company and I still haven't found the right person to talk to about this.

Improve this question
2
  • Which browser(s)? Do you use or can you try Firefox? It uses its own truststore not the systemwide one, and thus usually detects these enterprise proxies when other browsers don't.
    – dave_thompson_085
    Commented May 31, 2019 at 1:54
  • I've used Chrome. Im currently working from home via a VPN and I dont have the problem now. I will try again next week with firefox in the office.
    – maxeh
    Commented May 31, 2019 at 11:25

2 Answers 2

Reset to default
2

How is it possible to change all the certificates?

The company is performing SSL inspection on the HTTPS traffic with a transparent proxy. This requires terminating the connection e.g. at the firewall and creating a new TLS connection for the client. This requires creating new (fake) certificates and signing it with an own CA.

Why does my browser not complain about this?

The root CA used for signing the fake certificates is installed as a trusted CA to the certificate store the browser uses, but cURL or Java doesn't.

Does someone know why this is happening only for specific websites?

Some sites might be trusted i.e. the inspection is disabled for those sites. There are many practices, e.g. some companies might add manual exceptions, some could only inspect sites that aren't categorized as safe...

Improve this answer
2

How is it possible to change all the certificates?

MITM (Man-in-the-middle). Your company is using some kind of proxy device that is intercepting all your requests and generates a certificate on the fly for the address you try to connect. The proxy basically acts like a CA, signing all the "fake" certificates performing MITM. Some vendors tend to call it Outbound SSL Inspection.

Why does my browser not complain about this?

It works because each endpoint has that CA's certificate deployed in its certificate store (for Windows endpoints this is done via GPO), thus can verify that indeed the certificate sent by the server (in this case by the proxy impersonating the actual server) is signed by a CA that you explicitly trust! That's why you don't see warnings like your connection is not private the site's security certificate is not trusted!...

Does someone know why this is happening only for specific websites?

The proxy may have a set of rules or policies that skip various categories like banking not performing a MITM on them. Also on some websites you won't be able to perform a MITM because they may use technologies like certificate pining HSTS

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .