4 ms·
I don't particularly trust either, but: 1. The university is explicitly asking to MITM your traffic, so that's an automatic no-go on any of my devices for me.
by x1798DE 10y ago
I don't particularly trust either, but:
1. The university is explicitly asking to MITM your traffic, so that's an automatic no-go on any of my devices for me. At least other CAs will be punished if caught.
2. I'm fairly certain these university certs are not subject to certificate transparency, and even if they were, since they are explicitly designed to MITM traffic, I'm not sure that it would raise any red flags if someone other than the university was issuing these certs for inappropriate domains. At least TÜRKTRUST Elektronik Sertifika issuing inappropriate certificates are much more likely to get caught doing anything fishy (with high profile sites, anyway).
3. What you're really trusting is the vendor of whatever security gateway, not the university itself. If you look at the Security.SE thread I linked, there was an actual issue with at least one of the black box vendors. I don't think the other vendors are considerably better.
So, all-in-all, I would not accept an MITM certificate on any device that I used for anything personal, full stop.
- kuschku 10y agoYou do realize a CA can be limited to be trusted only for some things, yet not for others? For example, many such university certificates are not trusted as CAs for HTTPS?
- x1798DE 10y agoI was talking about MITM certificates. I don't really understand why a university is not just getting a certificate from a CA in the trusted store, but I would have many fewer qualms about something that is not a general MITM certificate. That said, my experience is that generally applications that have a legitimate reason for a limited-use self-signed certificate don't need to be in the general store. For example, it's common to set up OpenVPN with a self-signed certificate, but I've never had to add a certificate to the general store for that - it's always app-specific.