5

Everything has been well for years and today I wake up with this:

Certificate verification dialog

A warning on EM Client (also got the same on my iPhone) that the certificate for googleapis.com isn't valid. And the certificate happens to be not to Google but to LiveBox emitted by Orange (respectively my box to connect to the net, emitted by my ISP!)

Is this a sign that my ISP is trying to act as proxy between me and Google and get access to unencrypted data on the way?

9
  • 3
    That would be my suspicion
    – schroeder
    Commented Jul 8, 2015 at 5:10
  • 1
    A quick google for livebox ssl suggests that the Livebox Orange type router does indeed do some kind of SSL interception. But my French isn't good enough to actually make sense of it. Commented Jul 8, 2015 at 6:05
  • @StackzOfZtuff No all those messages are about actual connections "to" the box (admin console) for which it's perfectly normal for orange to provide a certificate, but this a problem that dates from today as orange is providing the certificate for Google (and there's no way that can work without a warning anyway), i think they messed up somewhere in an update Commented Jul 8, 2015 at 6:30
  • Can you view more details about the certificate?
    – user20574
    Commented Jul 8, 2015 at 9:46
  • @immibis not anymore since i don't get the error anymore Commented Jul 8, 2015 at 15:00

1 Answer 1

3

It is not unexpected for enterprise networks to run web security proxies that inspect encrypted traffic when given a reason to suspect something problematic. This allows them to detect encrypted malware and prevent it from infecting you. (It also allows them to restrict other content, such as porn or some other policy enforcement that is not related to security.)

I haven't heard of this for consumer-grade networks though. This is very disappointing and I suggest either finding another provider or at least using a VPN to tunnel your traffic through another location that does not inspect your encrypted data in this manner.

If you don't get the error any more (as noted in the comments above), contact technical support and ask about it. Perhaps something (e.g. DNS) was merely misconfigured, or perhaps the threshold for a "reason to suspect" your traffic was too aggressive. If they're wise, they should apologize profusely and try to win back your trust.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .