115

I found myself suddenly unable to access websites that use HTTPS, so I contacted my service provider, and they asked me to install a certificate in the Trusted Root Certificate Authorities store. But something isn't right: installing a certificate on every device connected to the same network just to be able to access websites that use HTTPS is just weird! How can I be sure that this certificate is issued by a trusted CA?

When I tried to install it, I got the following message:

Warning: If you install this root certificate, Windows will automatically trust any certificate issued by this CA. Installing a certificate with an unconfirmed thumbprint is a security risk. If you click "Yes" you acknowledge this risk.

Here is the certificate information:

  • Version: V3
  • Serial num: 00 f8 ab 36 f3 84 31 05 39
  • Signature algo: sha1RSA
  • Signature hash algo: sha1
  • Issuer: ISSA, Internet, Internet, Beirut, Beirut, LB
  • Subject: ISSA, Internet, Internet, Beirut, Beirut, LB
  • Public Key: RSA (1024 bits)

It's valid until 2019.

And by the way, I'm in Lebanon.

I contacted my ISP again and they told me that they're using some kind of an accelerator to enhance the speed, and it needs authentication, so they chose to use a certificate instead of making the user enter a username and password every time they wants to access websites that use HTTPS. And they suggested that if I'm not okay with that, they would put me in a new pool. So what should I do?

Improve this question
14
  • 76
    Sounds a bit dodgy. Like your ISP is middle-manning your HTTPS dodgy. What country/ISP? And can you give us the Cert details?
    – AlexH
    Commented Feb 2, 2015 at 17:13
  • 58
    yeah - ISP is doing MITM
    – schroeder ♦
    Commented Feb 2, 2015 at 18:40
  • 57
    Whoa, that's scary. In layman's terms, your ISP is asking you to install a backdoor on your computer so they can monitor and/or modify your web traffic to secure (HTTPS) sites. If you install this certificate, your ISP can read any information you send over the internet on secure sites. Anything. That includes passwords, bank account numbers, whatever. Note that for regular, unsecured (HTTP) traffic, they already have this ability unless you use a VPN.
    – Ajedi32
    Commented Feb 2, 2015 at 20:38
  • 29
    What your ISP told you is only a half truth! He is hiding the fact, that to accelerate your internet, he will use the certificate to deencrypt all your secure traffic, read it to compress it. This may (now) be done with good intentions (to save the ISP some money in infrastructure) - but this means you are wide opening your system and private data to a range of attacks and possible options to sell your private data
    – Falco
    Commented Feb 3, 2015 at 12:26
  • 7
    Not allowed to answer... Just wanted to add, that some ISPs infact do this without bad intents. I had a UMTS stick a while back from O2 (germany). To allow a "good browsing experience" they intercepted all my traffic to reencoded all images to a lower quality to save bandwidth. It is possible that your ISP is trying something similar. Try to contact them to tell them, that you do not wish this service.
    – example
    Commented Feb 4, 2015 at 22:14

6 Answers 6

Reset to default
129

Whilst I don't know the specifics of your ISP, I would say that it's likely that what they're doing here is intercepting all traffic you send over the Internet. In order to do that (without you getting error messages whenever you visit an HTTPS encrypted site), they would need to install a root certificate, which is what you mention in your post.

They need to do this as what this kind of interception usually entails is creating their own certificate for each site you visit. so for example if you visit https://www.amazon.com they need to have a certificate that your browser considers valid for that connection (which is one issued by a trusted Certificate Authority, either one provided with the browser or one you manually install).

From your perspective, the problem here is it means that they can see all your Internet traffic including usernames/passwords/credit card details. So if they want to, they can look at that information. Also if they have a security breach it's possible that other people might get access to that information. In addition, they may also gain access to any account that you access over this Internet connection (e.g., email accounts). Finally, installing this root certificate allows them to modify your Internet traffic without detection.

What I would recommend is that you query with them exactly why they need to see the details of your encrypted traffic (e.g., is this a legal requirement for your country) and if you're not 100% satisfied with the response, get a new ISP. Another possibility is to use a VPN and tunnel all your traffic through the VPN. If you are not happy with your ISP gaining this access to your HTTPS connections, do not install the root certificate they provided you.

Improve this answer
14
  • 40
    Note that even if you don't install the root certificate, this kind of behavior from your ISP probably indicates that they are already monitoring your unencrypted HTTP traffic (even if they can't monitor your HTTPS traffic without you installing the certificate or ignoring the security warnings from your browser).
    – Ajedi32
    Commented Feb 2, 2015 at 20:35
  • 38
    Also, it appears they're requiring you to take their man-in-the-middle certificate by blocking all SSL traffic until you do. This is SERIOUSLY invasive. I'd go shopping for another provider NOW. Oh, and go get TOR if/while you still can.
    – Eric Lloyd
    Commented Feb 2, 2015 at 22:06
  • 16
    Don't forget to check the cheksums of TOR to be sure they didn't intercept it too
    – Freedo
    Commented Feb 2, 2015 at 22:43
  • 20
    @Freedom: Check against what? Published checksums on HTTP sites might have been tampered, those on HTTPS are blocked. If OP posts a postal address, someone might mail him some checksum, but that someone might still be the ISP, government, secret service or whatever in disguise. It's hard to build trust without any kind of trust anchor. Enough different people providing the same fingerprints in enough different forums uwing enough different protocols (HTTP, IRC, News, Mail) may render consistent tampering less likely, but can you ever be certain, short of reading all TOR sources yourself?
    – MvG
    Commented Feb 3, 2015 at 1:40
  • 4
    @Freedom There are multiple ways to "find-and-replace", at an MITM proxy level, all valid hashes on the Internet, with those of the tainted package.
    – nanofarad
    Commented Feb 3, 2015 at 11:22
51

This is a request to surrender all your privacy and security to them.

It is a very simple technical issue - they have blocked encrypted and secure HTTPS connections. "Reenabling" it by installing their certificate will now allow you to use encrypted and "secure" connections, but it will give your ISP full access to view your online data, modify anything you download (including inserting backdoors or malware in any downloaded software), modify or filter anything you upload, and gain all the online access credentials (passwords, cookies, other security tokens) that you use through HTTPS.

This is not simply a potential theoretical risk. In fact, you should expect that they are already doing some or all of this - it's the only practical reason why they put the effort to block and require their certificate in the first place.

Only if you desire to have this connection despite the aforementioned issues, then you can accept their certificate. A good paid VPN can be a solution, however, it's possible that they will be blocking VPNs as well; it may be the case that you have to choose between a monitored and insecure connection controlled by someone else and no connection at all.

Improve this answer
6
  • If they block VPN or VPN ports, would it be possible to setup (a personal) VPN (server) over port 80 and use that?
    – SPRBRN
    Commented Feb 3, 2015 at 11:10
  • 1
    @SPRBRN Yes, but that would be pointless. If the VPN server is running on your local network, then it is subject to the exact same monitoring and restrictions by your ISP that you would be if you weren't using a VPN.
    – Ajedi32
    Commented Feb 3, 2015 at 14:49
  • 1
    Using a VPN-server that is on the same network as the client is pointless by itself. The VPN-server should be located elsewhere, either hosted with a VPN provider, or hosted in personal VPS. That last option would make it possible to run it on port 80 on that server. That was my suggestion. That traffic is allowed. It would be the same to run an SSH server on that server on port 80 instead of port 22.
    – SPRBRN
    Commented Feb 3, 2015 at 15:02
  • 1
    @SPRBRN Ah, I see. You were talking about bypassing the block by connecting to the VPN over port 80 rather than the usual port, not about setting up a personal VPN on your local network. Sorry for the misunderstanding.
    – Ajedi32
    Commented Feb 3, 2015 at 15:05
  • "it's the only practical reason why they put the effort to make this blocking & certificate in the first place" From the OP's edit, it looks like the OP's ISP has cited a different practical reason for doing this sort of MITM.
    – Ajedi32
    Commented Feb 3, 2015 at 15:06
15

In effect your ISP is reading all your mail.

Think of your internet connection as a series of letters being sent over pony express. The error you are seeing is your browser complaining that your mail has been opened by someone and resealed with the wrong wax seal rather than the expected, for example Google's, wax seal.

What your ISP is telling you to do is retrain your browser to treat the ISP seal as being more trust worthy than Google's seal.

The error is correct. It is telling you that your ISP is reading your mail. Don't do what they say. Change your ISP now.

Improve this answer
8

I agree this sounds very dodgy, but I might have an idea that might help, I can only assume you are using your ISP DNS servers, and I assume you are using a router. Why not just change the IP address to your external DNS server to something like Googles open DNS servers 8.8.8.8 and 8.8.4.4. If that stops the error message and assuming you have NOT installed the ISP certificate, then you know the problem is solved. It is very likely that is how they are controlling traffic, many people do not know how to manually change their DNS servers and everyone needs to use DNS to go to a website, so this idea might help.

Additionally you could go with a Private VPN service like https://www.privateinternetaccess.com/, I find their data center in Texas is great, but depending on where you are, you might like a different one, and they provide end to end encryption so that too might help. All that said, going to a new ISP is the best choice, the only way the ISP is going to learn, will be when they see their customers leaving for the competition.

Good Luck

Improve this answer
1
  • We had the same problem with a hacked router sending all traffic through a dodgy DNS.
    – Matthew Lock
    Commented Feb 6, 2015 at 0:35
4

I have done some research on the Lebanese Internet Regulation Act. Basically, your minister of information, Walid Al-Daouq, proposed a law in 2012 (which didn't make it) that would have put heavy stress on the freedom of speech in Lebanon.

The law has since been stopped, but it's possible that your ISP has come under pressure from the government to monitor Internet traffic on a national scale in order to find people that are threatening national security. Lebanese law has censorship for matters that affect national security, so it's not a stretch to assume that they'll ask ISPs to monitor all forms of traffice.

You might also have heard of Mia Khalifa. She's recently been voted the "Number 1 porn star", and since she's from Lebanon, the government is not happy with that. Her popularity might have something to do with the recent rush for monitoring.

Improve this answer
1
  • 1
    [citation needed] (I'm not disagreeing with you, I just think your answer would be better citing or linking to information found in your research)
    – IQAndreas
    Commented Feb 8, 2015 at 20:29
1

If they have done this, depending on your region, this may be looked at as a human rights violation under "right to private life".

The error you're receiving is actually a common problem.

Whoever you spoke to from your ISP may not know what you're talking about and simply fobbed you off asking you to install certificates.

Since getting this error, have you tried looking at your clock on your computer? If it's not set correctly, the time on certificates (which are set according to the certificate authority's time) will not be the same on your machines, therefore prompting you with a message such as, "your traffic is not secure".

Don’t simply allow the certificates as this defeats the purpose, and if you don’t know what you're doing, you can make mistakes which will cost you!

It is the job of a certificate authority, such as Verisign, to verify it and all you need to do is to make sure your systems are not compromised and you set your clock.

Improve this answer
3
  • 4
    +1 While I think that your tone is a bit uncalled for (don't try to add ideology into this, and don't talk down other people's contributions, especially if they find a lot of upvotes), I absolutely agree with the fact that one should check the simplest sources of errors first. An incorrect system clock has caused me that exact problem before!
    – Domi
    Commented Feb 3, 2015 at 14:48
  • 4
    People seriously need to stop moaning about "rights" when it's entirely illogical to do so.
    – Lightness Races in Orbit
    Commented Feb 4, 2015 at 16:28
  • Clock skew would result in every certificate looking like it has expired — there's no indication of that in the question.
    – 200_success
    Commented Feb 8, 2015 at 18:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .