0

This is a "should I be worried" question. I access a website on my laptop via my home network/router. My Edge browser gives me a "Your connection isn't private" warning page and a NET::ERR_CERT_AUTHORITY_INVALID error. When I check the certificate it looks ok, at least within validity period, hasn't been revoked and seems to have been issued by a valid issuer.

I change my network to my mobile phone as a personal hotspot, when I now access the site it is fine. When I checked the certificate it is issued by a different authority.

My question is, can this happen under legitimate circumstances? This feels like a man in the middle attack. How would I go about troubleshooting this?

Thanks.

Improve this question
2
  • This could be due to a weird configuration, but it's really suspicious. When you say the certificate "looks ok", how thoroughly did you check it? Since your browser thinks it's from an invalid authority, my guess is that it spotted a problem you missed.
    – Gordon Davisson
    Oct 1 at 8:13
  • Can you add info about the observed certificates? Which website was it?
    – vidarlo
    Oct 1 at 13:26

2 Answers 2

Reset to default
2

If this is only about a single site this might be a misconfiguration. A common problem is to have the right configuration with IPv4 but a wrong configuration with IPv6. Check SSLLabs. It might also be a DNS problem, i.e. some DNS resolver in between has cached an old IP for this site. Use nslookup or similar to check what IP you get in the different network setups.

If this affects many sites then there is likely some man in the middle in between. This might be a deliberately installed antivirus or corporate proxy where the CA is not properly installed as trusted into the browser. Or it might be an attack.

Improve this answer
0

After digging I realised it relates to OpenDNS. I was using OpenDNS to filter certain categories of website. When they do they return a This site is blocked page. When it does it uses a certificate issued by Cisco Umbrella CA, and this certificate is not trusted (at least on windows) by default. I've decided to use a different DNS service. I don't like the idea of installing a trusted root certificate, even if it does appear to come from a trusted source.

Improve this answer
1
  • I think the reason for browser error is that it’s redirecting you to their own landing page, hence the URL in the certificate (opendns.com) doesn’t match the URL of the site you requested.
    – Darren
    Oct 2 at 3:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .