3 ms·

No, but.... The above error was from my office. When connecting to ProtonVPN's website via a VPN, there is no error. Seems like it could be a certificate config

No, but.... The above error was from my office. When connecting to ProtonVPN's website via a VPN, there is no error. Seems like it could be a certificate configuration error with the network I'm using, which is odd because it's a University and I've not seen that error anywhere else I regularly visit.

bad_news_ 8y ago
Uh oh, your network is potentially unpacking SSL traffic for inspection. They've likely forced you to accept a self-signed root CA (probably as requirement to access wi-fi) so they can intercept and scan encrypted connections. Never do anything important or personally identifiable on that network. Scummy admins are running it.
HenryBemis 8y ago
>No, but.... The above error was from my office So.. IT that manages the certs and the gateway, use a MIMT 'attack' to decrypt all your traffic, scan/read it, and then encrypt it again to send it out to the wilderness of the Internet. This is what the browser is messaging. Notifying you that "something is wrong with the connection. Browser is not sure what exactly, thus pointing the finger on the certificate. Perhaps someone can explain the above with more technical terms, but in a nutshell, our companies, on our corporate desktops/laptops sniff through each and every bit and byte that goes in and out of our machines. A commom workardound "permanent accept this exception" (or similar wording) makes the browser to stop complaining about this breach of privacy.
- jsingleton 8y ago
  The reason this warning will appear in Firefox is that it does not use the OS certificate store and it uses a built-in store. The corporate MitM cert will have been added to the OS root cert store so other browsers will trust it but it probably hasn't been added to the Firefox one.
  - eggsome 8y ago
    Yep, sounds like they're lazy. They should be using a script like this to inject the cert into Firefox: https://github.com/eggsome/AddFirefoxCert https://github.com/eggsome/AddFirefoxCert Although: 1. I don't like to encourage this kind of behavior (I only use this for "good") 2. The certutil tool needs to be recompiled from the mozzila sources for new firefox.
- lunchables 8y ago
  >So.. IT that manages the certs and the gateway, use a MIMT 'attack' to decrypt all your traffic, scan/read it, and then encrypt it again to send it out to the wilderness of the Internet. Yup, typically referred to as "SSL Inspection" by the companies that produce products to monitor SSL traffic. Normally this is accompanied by controlling the clients and pushing a cert into their browser to avoid the warning messages.
  - lostlogin 8y ago
    Yikes. I think I like to see the browser warning.

bad_news_ 8y ago

Uh oh, your network is potentially unpacking SSL traffic for inspection. They've likely forced you to accept a self-signed root CA (probably as requirement to access wi-fi) so they can intercept and scan encrypted connections. Never do anything important or personally identifiable on that network. Scummy admins are running it.

HenryBemis 8y ago

>No, but.... The above error was from my office So.. IT that manages the certs and the gateway, use a MIMT 'attack' to decrypt all your traffic, scan/read it, and then encrypt it again to send it out to the wilderness of the Internet. This is what the browser is messaging. Notifying you that "something is wrong with the connection. Browser is not sure what exactly, thus pointing the finger on the certificate. Perhaps someone can explain the above with more technical terms, but in a nutshell, our companies, on our corporate desktops/laptops sniff through each and every bit and byte that goes in and out of our machines. A commom workardound "permanent accept this exception" (or similar wording) makes the browser to stop complaining about this breach of privacy.

jsingleton 8y ago
The reason this warning will appear in Firefox is that it does not use the OS certificate store and it uses a built-in store. The corporate MitM cert will have been added to the OS root cert store so other browsers will trust it but it probably hasn't been added to the Firefox one.
- eggsome 8y ago
  Yep, sounds like they're lazy. They should be using a script like this to inject the cert into Firefox: https://github.com/eggsome/AddFirefoxCert https://github.com/eggsome/AddFirefoxCert Although: 1. I don't like to encourage this kind of behavior (I only use this for "good") 2. The certutil tool needs to be recompiled from the mozzila sources for new firefox.
lunchables 8y ago
>So.. IT that manages the certs and the gateway, use a MIMT 'attack' to decrypt all your traffic, scan/read it, and then encrypt it again to send it out to the wilderness of the Internet. Yup, typically referred to as "SSL Inspection" by the companies that produce products to monitor SSL traffic. Normally this is accompanied by controlling the clients and pushing a cert into their browser to avoid the warning messages.
- lostlogin 8y ago
  Yikes. I think I like to see the browser warning.