I'm using Chrome 53 on Windows 7 on the Wi-Fi network of my university. Chrome complains that the connection may not be private. Here's the image:


When I go to the certificate path, I see:


How do I resolve this? Note that most other https:// sites work fine.

  • You must always include essential text from the error message as text in your question. – Jan Doggen Sep 5 '16 at 13:54

First, try visiting an unencrypted site (like Super User) to verify you can access the Internet. If you need to sign in to the network, you will be redirected.

If it still doesn’t work, you’re probably behind a Sophos UTM firewall that is performing SSL interception, a man-in-the-middle attack. If it didn’t perform SSL interception, it could not inspect/scan for viruses the contents transferred in the connection:

This is the way HTTPS filtering - just about ANY HTTPS filtering - has to work. HTTPS is an encrypted protocol. Normally, a "middle-man" - like a firewall - cannot snoop on the traffic at all. It has no way to decrypt the traffic, as the two endpoints negotiate the encryption algorithm and pass keys back and forth in such a way as to keep someone from just snooping and impersonating one side or the other.

The only way, then, to decrypt and scan that traffic, is to perform what, in the wild, anyway, would be the equivalent of a "man-in-the-middle" attack. The firewall therefore acts as the "client" and talks to the secure site, and generates a "fake" certificate to talk to the client, thus impersonating the secure site.

My recommendation is to stop using the network immediately. Depending on the configuration and behavior details, the UTM gateway may hide upstream (=“real”) certificate issues. It also has access to confidential information, e.g. online banking.

Although I cannot recommend it, you can also select to trust the firewall’s root certificate.

Of course, this still won’t work for sites using any form of key pinning.

Also: If the wireless network is unencrypted, stop using it immediately.

  • I am using the genuine network provided by the institution, and this kind of certificate faking is happening only for popular gaming sites. When I finally proceed anyway to lichess by disabling HSTS, it says "This site has been blocked under ... category." – neverdie Sep 5 '16 at 8:33
  • Yeah, so what if it is “genuine”? It’s just not acceptable. – Daniel B Sep 5 '16 at 8:40

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.