Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Before I access the internet at work I have to sign-on to their system. The sign-on page is ipass.swu.ac.th. Unfortunately the security certificate they use appears as not trusted (in Chrome). I have to click 'Proceed Anyway' every time I want to access their log-on page.

I can see from this answer that I can export their certificate and then add it as a trusted root certification authority in Windows.

My question is this. I don't actually trust the network. I work in a university in Thailand, and many computers on the network are laden with viruses. I don't even trust the computer center that is responsible for IT here. So I only want to trust their certificate in order to access their log-on page, ipass.swu.ac.th, and no more. If I add their certificate as a trusted root authority, I don't know how far this trust extends.

To give a concrete example, when I open iTunes, if I haven't previously logged-on to ipass.swu.ac.th, it complains that it cannot securely reach Apple's servers. That's good - I want to keep that warning. I want to share only my University Username and Password with ipass.swu.ac.th. I don't want to share any other credentials with them, and I'm worried that if I trust the authority, that applications like iTunes may share private information with the university computer center.

share|improve this question

1 Answer 1

up vote 5 down vote accepted

A trusted root certificate is one that's trusted to issue certificates for other domains. If you add your university's certificate as a trusted root, it becomes possible for the university to impersonate other SSL-protected websites in order to intercept and eavesdrop on your connections to those sites. (This is known as a man-in-the-middle attack.)

This is something that the university would have to do on purpose — they won't "accidentally" get information from your applications just because you installed the certificate — but it's not unheard-of. Some corporate IT departments install a corporate root certificate on all their computers specifically for this reason.

If your university's network security is poor, it's also possible that an outside attacker may break in and steal the private key to the university's certificate. This would allow the attacker to impersonate the university in SSL connections, and if you've installed it as a trusted root, the attacker could use it to impersonate other SSL sites as well.

share|improve this answer
    
That's perfect, and it's what I had feared might be true. Thank you so much. So I wonder if there is any way to add it as a non-root certificate - valid only for its own domain. –  oldmankit Mar 27 at 7:31
    
In Firefox, you can do that by adding an "exception" for the certificate. I don't use Chrome so I don't know if it has an equivalent feature. –  Wyzard Mar 27 at 11:39
    
Chrome used to, but not any more. –  oldmankit Mar 28 at 5:10

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.