How to intercept SSL authority certificate needed in a corporate environment?

Question

My situation is the following: in our corporate network a special kind of SSL certificate issued by the company itself is used. Every time I open a site via https in Firefox a warning monit is displayed saying "sec_error_unknown_issuer". In certificate details it says that this particular certificate was issued by my company, there is a company address and name and everything. It's very annoying because I need to add an exception for the invalid certificate every single time I go to an SSL encrypted site. One possible solution would be to give up SSL and use plain http when possible (there is no difference between SSL and no-SSL at the moment if the network admins handle the certificates themselves I guess) but some sites do not work without SSL, such as bank login pages. So I think the better idea would be to add the certificate to Firefox list of trusted authorities. To do this, I need to have an authority certificate. I tried to get it with the following Openssl command but to no avail:

openssl s_client -connect hostname:port

It shows one certificate but and then it stops because some certificates could not be verified and the certificate is incorrect because Firefox display an error when I try to import it. I don't remember the exact message now but it was something like "this certificate is not valid authority certificate".

I also tried to use Wireshark but can't use too good and I failed to grab what I was looking for. And as the last resort, it's impossible to disable SSL certificates validation in Firefox.

So how can I grab this local authority certificate that I could import to Firefox and stop being annoyed by the error messages?

Answer 1

If you're using corporate network or you trust the issuer, you've to import given certificate into your keychain and make it trusted for your SSL connection. To make it work for all web addresses, it needs to be Root certificate authority.

In Chrome you can basically click on padlock icon, then Connection tab, so you can see the Certificate Information which should consist CRT link in your Root (top one) certificate.

Once you downloaded certificate file or by the following command:

openssl s_client -connect example.com:443 < /dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > foo.crt

open the file and in trusted settings make it Trust.

On OS X you can double-click on the file or drag and drop in your Keychain Access, so it'll appear in login/Certificates. Then double-click on the imported certificated and make it Always Trust for SSL (as shown below).

Now all HTTPS/SSL websites should work fine.

Answer 2

Add the -showcerts option to make s_client print the entire chain.

Answer 3

I am facing the same problem today, and every time I try to connect a site, all mozilla products ask for permission to add certificate. And that certificate only certifies for the specified website.

In order to add your corporate certificate into the trusted authorities, go to Control Panel -> Internet Options -> Content -> Certificates -> Trusted Root Certification Authorities

And a list appears there. Find your corporate certificate, and export it to a file, with wizard's default options.

After that open firefox, Options -> Advanced -> View Certificates -> Authorities -> Import

Select the file that you have exported, and check all the trust options.

Now you will be able to connect all the websites.

Answer 4

If you can't get the certificate of the corporate web proxy, add your own local proxy (e.g., Burp Suite proxy) between the browser and corporate proxy, and install the local proxy's certificate in your browser. Configure your browser to use the local proxy (Options -> Advanced -> Network -> Connection Settings). The browser then only sees certificates issued by your local proxy, which is trusted, and you see no errors in the browser.