Is it safe to add an untrusted certificate to Trusted Root Certification Authorities?

Question

Before I access the internet at work I have to sign-on to their system. The sign-on page is ipass.swu.ac.th. Unfortunately the security certificate they use appears as not trusted (in Chrome). I have to click 'Proceed Anyway' every time I want to access their log-on page.

I can see from this answer that I can export their certificate and then add it as a trusted root certification authority in Windows.

My question is this. I don't actually trust the network. I work in a university in Thailand, and many computers on the network are laden with viruses. I don't even trust the computer center that is responsible for IT here. So I only want to trust their certificate in order to access their log-on page, ipass.swu.ac.th, and no more. If I add their certificate as a trusted root authority, I don't know how far this trust extends.

To give a concrete example, when I open iTunes, if I haven't previously logged-on to ipass.swu.ac.th, it complains that it cannot securely reach Apple's servers. That's good - I want to keep that warning. I want to share only my University Username and Password with ipass.swu.ac.th. I don't want to share any other credentials with them, and I'm worried that if I trust the authority, that applications like iTunes may share private information with the university computer center.

Answer 1

A trusted root certificate is one that's trusted to issue certificates for other domains. If you add your university's certificate as a trusted root, it becomes possible for the university to impersonate other SSL-protected websites in order to intercept and eavesdrop on your connections to those sites. (This is known as a man-in-the-middle attack.)

This is something that the university would have to do on purpose — they won't "accidentally" get information from your applications just because you installed the certificate — but it's not unheard-of. Some corporate IT departments install a corporate root certificate on all their computers specifically for this reason.

If your university's network security is poor, it's also possible that an outside attacker may break in and steal the private key to the university's certificate. This would allow the attacker to impersonate the university in SSL connections, and if you've installed it as a trusted root, the attacker could use it to impersonate other SSL sites as well.