8

I recently found out that in order to log on to the web-based administration tool on my ISP-provided router, I need to accept a self-signed certificate it offers. I did a bit of reading and it sounds like self-signed certificates issued by an ISP can enable the ISP to perform MITM attacks on computers that accepted the certificate. (see Is it common practice for companies to MITM HTTPS traffic?)

Is this something I should be concerned about in my situation? If I accept the certificate, will I potentially be compromising end-to-end encryption with parties other than the ISP or my router's software?

When I view the details of the certificate, it says "Root certificate authority". Is this a synonym for self-signing or can this certificate be used for a MITM attack?

Here are screenshots of the details of the certificate, with things that looked like I shouldn't spread around on the internet blacked out:

Screenshot 1: enter image description here

Screenshot 2: enter image description here

Screenshot 3: enter image description here

3
  • 5
    The data you've redacted isn't secret (although it may be unique to your router). And the exponent is 65537. :P
    – forest
    Dec 20, 2019 at 22:37
  • 2
    Haha yeah, better to be safe than sorry. :D
    – user109923
    Dec 20, 2019 at 22:57
  • 3
    You will not be any bit safer, because the info in the certificate is intended to be public :)
    – mentallurg
    Dec 21, 2019 at 6:42

1 Answer 1

6

Not only is the certificate you show self-signed, but it's also a certificate authority, which means that it can issue more certificates for any website.

basic constraints showing that it's a CA

If you install that certificate into your browser as a trusted certificate authority, then yes, your ISP will be able to do the kind of MitM attacks that you're referencing.

I don't know whether simply clicking through the cert warning on that one page will install in, or simply ignore the warning for that one page. My guess is that if you click through this warning, this certificate will then show up in your browser's Trust Store of trusted Certificate Authorities, which would be bad.


I would be inclined to say that your ISP is not malicious, but rather they don't really understand how certificates work. If they were trying to MitM you, they would have persuaded you to install the cert when you first set up the router saying "The internet won't work without it", and indeed, you'd probably see all sorts of weird certs errors on otherwise normal websites, like google.com.

6
  • 2
    The wording of the warning doesn't seem to imply which one it does: i.stack.imgur.com/bHEH1.png
    – user109923
    Dec 21, 2019 at 3:11
  • 1
    Are there any technical reasons why my ISP would want the certificate to have CA capabilities? If I contact my ISP and ask them to replace the certificate with one that does not claim CA capabilities, would they have any reason to object to that?
    – user109923
    Dec 21, 2019 at 22:38
  • 1
    @user109923 No matter if they have a legitimate reason or not, they will probably not change it anytime soon anyway. Just you calling is not the pressure they’d need for a quick change here, I’d say.
    – caw
    Dec 22, 2019 at 15:58
  • I agree with @caw; to my knowledge, the certs on an ISP-issued modem are installed at manufacture time and are difficult to update in the field. Dec 23, 2019 at 14:56
  • 1
    @user109923 To do a signing key properly, the private key needs to be unique per device, and the only copy of the private key should be on the device. It's *possible* to do this is the field, but a lot more complicated than pushing the same patch to every device. Dec 24, 2019 at 14:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.