0

I know that similar questions has been asked several times, but this question focuses on one aspect I did not found answered yet.

Recently when I was connecting my iPhone to my school wifi (eduroam), it asked me to trust a wifi certificate. How do I differentiate between those that are able to MITM me and those that aren’t? Are there any parameters/description on the details of the certificate that makes them distinct?

The certificate I was presented with was:


>Issuer Name
>Organization: QuoVadis Limited
>Common Name: QuoVadis Global SSL ICA G3

>Basic Constraints
>Critical: No
>Certificate Authority: No

>Certificate Authority Info Access
>Critical: No
>Access Method: CA Issuers
>URI:http://trust.quovadisglobal.com/qvsslg3.crt
>Access Method: Online Certificate Status Protocol
>URI: http://ocdp.quovadisglobal.com

>Extended Key Usage
>Critical: No
>Purpose: Client Authentication
>Purpose: Server Authentication

>Key Usage
>Critical: No
>Usage: Digital Signature, Key Encipherment
Improve this question
7
  • "I know this question has been asked several times, but I want to make sure that it is OK." - Why do you think that asking again will lead to different answers? Since you are aware of the other questions please only ask the parts which are not already answered in the other questions. In short: properly installed this certificate is usable for authentication against the WiFi network only. It will not allow to actively MITM TLS traffic. Of course, connecting to any network will allow the network operators to passively monitor traffic, but not to actively MITM TLS.
    – Steffen Ullrich
    Commented Feb 12, 2022 at 10:10
  • @SteffenUllrich , What i m asking is how do I differentiate which certificate will allow the operators to MITM me and which will only allow for authentication purposes only.
    – mxmx
    Commented Feb 12, 2022 at 10:17
  • Then please show your current understanding based on existing answers and reduce your question to exactly this point you feel not answered yet. But in short: The difference is not in the certificate but how you install it: if you install it for authentication of the WiFi only then it can only be used for this. If you install it as a generic root CA trusted for everything then it will be usable for active TLS MITM too.
    – Steffen Ullrich
    Commented Feb 12, 2022 at 10:22
  • @SteffenUllrich Thank you for the advice, I have edited the question. Yes, how should I differentiate between two certificate when installing them? How do I know one is for authentication purposes only and one is installing myself a root CA? Thanks
    – mxmx
    Commented Feb 12, 2022 at 10:26
  • I've changed your question and title to be more focused on what I understand you want to know. Hope this fits your problem.
    – Steffen Ullrich
    Commented Feb 12, 2022 at 10:34

1 Answer 1

Reset to default
0

How do I differentiate between those that are able to MITM me and those that aren’t? Are there any signs/description on the usage of the certificate that makes them distinct?

CA certificates usable for MITM and usable as trust anchor in WiFi authentication are not really different. The difference is how these certificates are installed in the device: If they are specifically installed for authentication against a WiFi network only, then they will be only used for this purpose. If they are instead installed as a general purpose CA then they will also be used as a trust anchor in web traffic and other TLS connections and thus can be used for actively MITM TLS traffic.

But note that in your specific case you are not dealing with a CA certificate at all. You are only asked to install the leaf certificate specific for your current network. This can be seen from:

Certificate Authority: No

A CA certificate would have a "Yes" here and only a CA certificate is able to issue other certificates as needed in active TLS MITM attacks.

Improve this answer
5
  • Is there any way for me to identify whether a particular certificate is for authentication purpose or general purpose CA? Or is there a way for me to differentiate the type of installation?
    – mxmx
    Commented Feb 12, 2022 at 10:35
  • @mxmx: See updated answer about your specific certificate. In general: have a look at the certificate management on your device. For example current Android versions clearly distinguish between CA certificates, VPN certificates and WiFi certificates.
    – Steffen Ullrich
    Commented Feb 12, 2022 at 10:40
  • @mxmx In iOS CA certificates have to be explicitly to be activated as trusted root CA certificate support.apple.com/en-in/HT204477
    – Robert
    Commented Feb 13, 2022 at 14:41
  • @Robert meaning even if I installed CA certificates, but do not explicitly activate them in the settings, it won't have any effect?
    – mxmx
    Commented Feb 14, 2022 at 15:02
  • @mxmx I am not sure what effects an CA certificate has that is just installed, but unless you explicitly trust it it does not have any effect on SSL/TLS connections by apps or the system itself.
    – Robert
    Commented Feb 14, 2022 at 15:06

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .