5

Everything has been well for years and today I wake up with this:

Certificate verification dialog

A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate happens to be not to Google but to LiveBox emitted by Orange (respectively my box to connect to the net, emitted by my ISP!)

Is this a sign that my ISP is trying to act as proxy between me and Google and get access to unencrypted data on the way?

  • 3
    That would be my suspicion – schroeder Jul 8 '15 at 5:10
  • 1
    A quick google for livebox ssl suggests that the Livebox Orange type router does indeed do some kind of SSL interception. But my French isn't good enough to actually make sense of it. – StackzOfZtuff Jul 8 '15 at 6:05
  • @StackzOfZtuff No all those messages are about actual connections "to" the box (admin console) for which it's perfectly normal for orange to provide a certificate, but this a problem that dates from today as orange is providing the certificate for Google (and there's no way that can work without a warning anyway), i think they messed up somewhere in an update – Ronan Thibaudau Jul 8 '15 at 6:30
  • Can you view more details about the certificate? – user253751 Jul 8 '15 at 9:46
  • @immibis not anymore since i don't get the error anymore – Ronan Thibaudau Jul 8 '15 at 15:00
3

It is not unexpected for enterprise networks to run web security proxies that inspect encrypted traffic when given a reason to suspect something problematic. This allows them to detect encrypted malware and prevent it from infecting you. (It also allows them to restrict other content, such as porn or some other policy enforcement that is not related to security.)

I haven't heard of this for consumer-grade networks though. This is very disappointing and I suggest either finding another provider or at least using a VPN to tunnel your traffic through another location that does not inspect your encrypted data in this manner.

If you don't get the error any more (as noted in the comments above), contact technical support and ask about it. Perhaps something (e.g. DNS) was merely misconfigured, or perhaps the threshold for a "reason to suspect" your traffic was too aggressive. If they're wise, they should apologize profusely and try to win back your trust.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.