9

My university requires me to install a custom root CA to connect to their wifi network. When I installed it on my phone, it let me specify "Wifi" or "VPN and apps". I chose wifi, and was able to connect successfully.

However, I'm concerned about the security of this certificate. I don't know who is responsible for it at my university, and whether it's a group of volunteer students who don't know what they're doing.

When I chose the "Wifi" option, does that mean the CA will only be used to authenticate with the wifi network and not for anything else? So if the private key gets leaked and someone tries to make a phishing site using HTTPs to target students, would Chrome/whatever browser I have installed accept an HTTPs certificate for a site signed by the CA I installed for wifi?

I'm on Android 7.1.1

Improve this question
2
  • 1
    I'm curious: Take a look at the certification chain on something simple like Google.com. If your is very different from mine, I'd be concerned: imgur.com/a/s7pLV
    – Tim G
    Jul 26, 2017 at 19:58
  • Oh, a caveat, if your CA chain looks like mine, it doesn't mean everything is fine, but this is where I'd look first. If it's different, I'd expect to see something like Bluecoat, indicating a man-in-the-middle proxy.
    – Tim G
    Jul 26, 2017 at 20:17

2 Answers 2

Reset to default
1

A certificate authority signs digital certificates. Often times companies will pay an internationally trusted CA such as VeriSign or DigiCert to sign certificates on their own domain.

In some cases it may make more sense to act as your own CA, rather than paying a CA like DigiCert. Your university is doing exactly that, ie using their own certificate authority.

The first thing to understand is that the root CA that you installed is not a private key, but a public key. Take a look at your certificates on the browser you are using and look at the authorities tab, you will see a whole bunch of root CA such as VeriSign.

So lets say your university has an informational webpage university.edu. With out installing the root CA onto your device if you were to go to the web page you would see an error warning you that the site is not trusted. After installing the root CA, the site will show as secure since it is verifing that it is valid using the public key on your device. The unversity.edu webserver will have a private key that correlates to the public key you have. So when you access the webpage it verifies it is a valid site.

In essence having the root CA is not an issue. The only key that could potentially cause major issues if compromises is the root CA private key. Typically CA's are set up with a root CA and then an intermediate CA. The root key is kept offline so that it can not be compromised. That way if the private key used to sign Certificate requests on the intermediate CA is compromised, a new private key would be generated using the root Private key. This would require reissuing keys to all the servers that are verified, but does protect the environment.

Hope this helps.

Take a look at this documentation for setting up a certificate authority for more detailed understanding of how a certificate authority works.

https://jamielinux.com/docs/openssl-certificate-authority/introduction.html

Improve this answer
0

I find the other answer here very misleading.

Installing a root CA is a HUGE risk. That means almost all of your network traffic can be intercepted (which can lead to bigger problems).

But, I'm not sure this is the case. I think you didn't installed a Trusted Root CA, but instead just a "Server Authentication" CA so your client (your phone) will be able to verify the RADIUS server which is used for authenticating your credentials to the WPA2-Enterprise Wi-Fi.

This is quite common in universities.

That means your university can't sign any certificate for any domain other than the specified server.

Though this is not certain. If you could update your question with a few screenshot of the request you got - I can say with certainty.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .