Corporate admins are issuing ssl cert for google.com?

allyc1057 · 3 months

Correct re. the decryption, sounds like they're acting as a Man-in-the-Middle (MITM), whereby your google.com connections are being proxied through their own SSL proxies, they therefore hold the key to your search queries (as well as other Google services such as GMail, potentially).

You could potentially set up an SSH server (with SSH server configured to run on port 80, to ensure it's permitted through your corporate WAN) on your home network, and use it to tunnel HTTP(S) traffic out through your own home, bypassing the corporate proxies.

http://travisaltman.com/tunneling-http-thru-ssh/

Alternatively, if your company allows VPN traffic out, you could maybe look for a VPN tunnelling service..

RouterMonkey · 3 months

Yep. They are doing this so that they can run HTTPS traffic through the proxy servers, and apply filtering to HTTPS traffic.

Normally, HTTP is run through the proxy, and HTTPS isn't, because the only way to do this is to issue internal certs, like this.

SteveJEO · 3 months

If the cert was issued by your own company and presuming your own company isn't google then yes.

Something is SSL bridging from the sounds of it.

Here is what happens.

Normally you have a single tunnel between the client and server. (this can exist within a VPN or whatever the encapsulating traffic doesnt matter)

You>----------------(Google SSL Tunnel)---------------> Google.com

Now what you have is a break in that SSL tunnel so it looks like this.

You >---(corp SSL tunnel)-----> Corp Firewall >--(google tunnel)----> google.com

Your system is smart enough to know the corp SSl tunnel is pretending to come from google and is warning you about it.

All traffic you pass to google will be decrypted at the corp firewall, scanned and recorded, then re encrypted with googles cert and passed on.

(so basically google wont know the difference since the traffic they get will be legitimately encrypted using their keys.)

Edit: you might not like it, but this stuff is actually normal on enterprise environments. You can just as easily download compromising or illegal software & material from a secure site as you can from anywhere else and the corp network integrity relies on knowing about it. You 'could' bypass it, but in the event you do become compromised you will have successfully introduced a compromised system to their network and they won't be happy... at all.

The very fact that your system is flagging at all suggests to me that your machine is unmanaged and unaccountable on the network.

timschwartz · 3 months

What are your DNS servers set to?

http://www.skylabs.asia/google-shows-ssl-error-on-opendns-connections/

mrjester · 3 months

As others have stated, it is ssl decrypt for security purposes. It allows several things such as: URL filtering, IPS/IDS inspection, data-defiltration and forensics analysis. It is very likely that if they are doing SSL decrypt, you will also not be able to run other protocols (ssh) over 80 or 443. The proxy device will ensure protocol compliance.

Many devices that do SSL Decrypt also support categorization in that they can categorically decide what connections to decrypt or not. Such as banking. Decrypting your banking traffic opens a HUGE door for liability.

carlivar · 3 months

Easiest way to get around it is if you can find a TCP or UDP port open to the public Internet. Any port. Set up a SOCKS proxy out on the Internet listening on that port, and there you go. I have a linode.com host out on the Internet for general purposes like this.

If it's completely locked down, may not be possible. You could try ICMP tunneling if that's open, but it's much more complicated.

This all assumes you can even change your proxy settings. If not, you are out of luck.

Going cellular data is of course another option.

bithead · 3 months

MY company does this also, using IRonport. problem is, they reuse cert serial numbers., so it breaks firefox going to google.

midwestgator · 3 months

It will be more and more common. Major firewall vendors pushed it out a few years ago, so a lot of companies are adopting it now.

Watch out for your banking sites if you ever use them at work. If done right finance sites should be setup to bypass SSL decryption.

m1ss1ontomars2k4 · 3 months

I wouldn't rush to conclusions here, unless the certificate was also for google.com. When I first sign on to certain wireless networks, my AIM client asks me if I want to accept a certificate for logon_webpage.example.com, which is obviously not the correct certificate, although it could easily be valid.

ehudt · 3 months

You should try out [Ultrasurf or UltraVPN](ultrasurf.us). It's an encrypted proxy. Basically, all the traffic is encrypted, so no one can see your stuff. It was designed to bypass Chinese government censorship, and so it is very good at evading firewalls and other network screening products. I hope it helps you out...

Ultrasurf on Wikipedia

timschwartz · 3 months

I have experienced something similar when attaching my iphone to the wireless network I run. Usually, turning off wifi and turning it back on makes it go away.

Try reconnecting.

you'll need to login or register to do that

create a new account

login