Certificate Issuer is Network Company

Question

I simply want to know if is this normal, abnormal, deceptive, illegal, etc...

I am at work. When I bring up a certificate for most domains, I get a very standard certificate. When I bring one up for Facebook or Twitter (social media sites), the certificate throws a warning. The warning is because they are untrusted. Looking at the certificate, the Issuer is the company that runs the local network in our building. It is not a standard issuer.

This is exactly how it is listed (replacing the company name with xxx.com):

Issuer: DC=com, DC=xxx, CN=XXXsubCA

Answer 1

Some companies are very concerned about information leaking onto social media sites. Because of this, they will put in proxies that inspect the content of data sent to social media. When they do this, they issue their own certificate, and it behaves in the way that you describe.

Is it normal? Not for the average user, but increasingly normal in corporate environments

Is it deceptive? Sort of, but you might have been notified of this kind of thing in a corporate policy

Is it illegal? That really depends on your jurisdiction. But, as I said, it is becoming increasingly common, and in many jurisdictions is legal (with or without notification).

The other question you need to ask is, "what is my risk?" And here it is: Because they are interested in the content of what you post, it is likely that they store, inspect, and alert on that content. That means that everything you post goes to your company. All communication (to those sites) is no longer private to you and your intended audience, but is exposed to those who are authorized to view such information in your company.

Answer 2

In the United States, the practice might fall in violation of national privacy law. I can't say with certainty, however I believe that clear notice must be given to all users of a network where the benefit of privacy normally offered by—and therefore typically expected of—a secured connection is not intact.

Furthermore, there is a security risk at hand: based on the fact that you had to ask about this here (issuer of the certificate was not trusted), it seems likely that other employees—especially those who aren't as skeptical as you—would in time become desensitized to those warnings, eventually taking for granted the validity of any untrusted certificates issued under that name. There is the possibility here that another machine on the network will intercept the traffic with untrusted certificates under that same name, and potentially cause even more harm than just casual day-to-day infringements on employee privacy.

If not illegal, it certainly is at least an unethical and potentially harmful practice in the case where disclosure of the act is not given to network users, and especially where network users are not even informed of how to add the CA as a trusted issuer.

Answer 3

Generally they don't want to encourage people accessing the outside sites with the proper standardize way as there is a chances it lead to many problems such as policy violation, malicious attacks and also data leakage. To protect these all from external world, they can have third party servers it may be proxy or what ever ( the company bought ) will check the complete packet analysis and encrypt the contents on their own CA setup configured on the third party server. Such servers as Blue coat , FireEye , Websense, etc