2

At home I use a router (Huawei B528s-23a), the default device which my provider recommends.

Over the last couple of days I often get a certificate error when opening a website which was obviously not the routers page.

In Safari for example:

Safari: certificate is not trusted

It's seems that the router answers the SSL-Connection instead of the page I wanted to open. Is there any explanation for this strange behavior?

ps: I'm not a native English speaker; Please forgive for my potentially mistakes.

  • Given that the certificate is for mediarouter.home and not the site you were trying to visit this looks more like a captive portal than TLS interception. Does the router redirect you somewhere if you visit a site without TLS such as neverssl.com? – AndrolGenhald Sep 21 at 20:05
  • I do not know; in fact the most sites use TLS. I will disable everything which looks like web filter, and if it occurs again, I will clarify the issue. – Felix. v. O. Sep 22 at 18:07
0

While it is the typical case of https eavesdropping, most likely there is no malicious intent in the background.

For example, the router can provide some web filtering or other defense for you with it.

Furthermore, it is impossible to be done without your consent: the manufacturer can't create such SSL certificates to the domains you visit, what are commonly accepted by all the browsers you use. You will surely see the warnings of your browsers due to failed certs.

On this reason, doing this for malicious purposes is practically impossible by router manufacturers.

I think it is more likely that you switched some content-based web filtering function of the router on, but did not read the docs saying, how to import the certs of the router into your browser (requires typically many clicks).

Check the router docs, and turn this off. From a router manufacturer, I want a router, not a virus filter.

0

According to page 9 of the product spec sheet this router does have a built in firewall that can filter URLs.

You are probably going to want to:

  1. Disable the URL filtering
  2. Or update the router firmware which may result in a updated certificate.
  • How would updating the router's firmware help? If this certificate is actually embedded in the firmware that's a huge security issue, but either way that's not going to cause the certificate to be trusted by the devices connected to the router. – AndrolGenhald Sep 21 at 20:01
  • It's not long ago ZyXEL had hard coded private keys and certificates on their firmware, CVE-2015-7256. – Esa Jokinen Sep 22 at 4:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.