0

This is a "should I be worried" question. I access a website on my laptop via my home network/router. My Edge browser gives me a "Your connection isn't private" warning page and a NET::ERR_CERT_AUTHORITY_INVALID error. When I check the certificate it looks ok, at least within validity period, hasn't been revoked and seems to have been issued by a valid issuer.

I change my network to my mobile phone as a personal hotspot, when I now access the site it is fine. When I checked the certificate it is issued by a different authority.

My question is, can this happen under legitimate circumstances? This feels like a man in the middle attack. How would I go about troubleshooting this?

Thanks.

2
  • This could be due to a weird configuration, but it's really suspicious. When you say the certificate "looks ok", how thoroughly did you check it? Since your browser thinks it's from an invalid authority, my guess is that it spotted a problem you missed. Commented Oct 1, 2023 at 8:13
  • Can you add info about the observed certificates? Which website was it?
    – vidarlo
    Commented Oct 1, 2023 at 13:26

2 Answers 2

2

If this is only about a single site this might be a misconfiguration. A common problem is to have the right configuration with IPv4 but a wrong configuration with IPv6. Check SSLLabs. It might also be a DNS problem, i.e. some DNS resolver in between has cached an old IP for this site. Use nslookup or similar to check what IP you get in the different network setups.

If this affects many sites then there is likely some man in the middle in between. This might be a deliberately installed antivirus or corporate proxy where the CA is not properly installed as trusted into the browser. Or it might be an attack.

0

After digging I realised it relates to OpenDNS. I was using OpenDNS to filter certain categories of website. When they do they return a This site is blocked page. When it does it uses a certificate issued by Cisco Umbrella CA, and this certificate is not trusted (at least on windows) by default. I've decided to use a different DNS service. I don't like the idea of installing a trusted root certificate, even if it does appear to come from a trusted source.

1
  • I think the reason for browser error is that it’s redirecting you to their own landing page, hence the URL in the certificate (opendns.com) doesn’t match the URL of the site you requested.
    – Darren
    Commented Oct 2, 2023 at 3:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .