16

I am new to Linux and learning Linux on Ubuntu 18.0401 LTS installed on oracle virtualbox on company system. Company has private proxy network. So all the websites I browse on ubuntu pass through proxy and get ssl certificate issued by the company. When I browse from chrome/firefox it gives error like not a trusted source. When I go to > advance > add exception I can browse that particular website for some time and then again after some time same error (probably certificate details changes) In browser atleast I can browse after such effort but the Ubuntu software does not even give such option and I am simply not able to download any software. Also CLI apt-get dont work. Can someone tell a way to configure such a way that we completely bypass ssl validation system wide? something like --disable ssl certificate validation.. So that I am able to seamlessly connect to internet ? (of course websites blocked by proxy will still be blocked)

Thanks a ton in advance!!

NK, Linux enthusiast

PS: Below is the error on firefox;

"Your connection is not secure The owner of support.mozilla.org has configured their website improperly. To protect your information from being stolen, Firefox has not connected to this website."

Improve this question
4
  • Have look here: askubuntu.com/a/94861/783023- I think you only need to install the root certificate of your company (or your companies proxy) - then you should be fine. Keep in mind that some apps, like Firefox, have their own keystores so the answer below also applies.
    – Robert Riedl
    Jan 31, 2019 at 15:07
  • 1
    It should probably be obvious to those familiar with the matter, but I'm going to state it anyway. Installing a root certificate makes you completely trust the owner of that certificate. This means said owner can e.g. man-in-the-middle your connection and decrypt all your https traffic, just like your browser has warned you when you used the company proxy without having installed the cert. You probably can not avoid that if it is the IT policy of your employer that you must use their proxy, but you should be aware of it and avoid transmitting anything personal (banking, private logins, ...)
    – Byte Commander ♦
    Feb 1, 2019 at 20:16
  • @ByteCommander, this is very true. In fact, if I'm interpreting OP correctly, he is currently (not maliciously) man-in-the-middled, due to the proxy service that breaks SSL. Also, disabling SSL will also make you vulnerable to man-in-the-middle attacks.
    – Robert Riedl
    Feb 4, 2019 at 16:35
  • Thank you for responses experts. Problem is IT team wont give me certificate, as the virtual box has already been given after so many approvals. They wont bother because I am using Ubuntu for self learning purpose and nothing is stuck for them.
    – Nikhil Kadi
    Feb 6, 2019 at 8:48

2 Answers 2

Reset to default
50

Disable SSL certificate validation in Ubuntu totally

Fortunately that is not really possible apart from compiling the relevant applications again and disabling certificate validation in the code.

The proper way to proceed is not to disable validation but to add the CA certificate used by the proxy as trusted. This way you can use the proxy without any warnings but are still not vulnerable to arbitrary man in the middle attacks like you would be if you disable all validation.

Please ask your network administrators for the proper CA certificate and then install it as described for example here for Firefox (although this specific site is for Windows it is the same with Firefox on Linux).

Improve this answer
11

The correct way about this is to add the CA certificate(s) used by the proxy. If they are rotated frequently this may indeed become annoying. To install the certificates such that they are used by most applications (unlike Firefox which uses its own certificate store), do the following:

  1. Obtain the certificate(s) in Base64 encoded X.509 format.
    An easy way to obtain them is through Chrome via Settings, Advanced, Manage Certificates on an IT managed/auto-updated system.
  2. Copy them to /usr/local/share/ca-certificates
    (Optionally make a new subfolder)
  3. If the extension is not .crt rename the files.
  4. sudo update-ca-certificates

When repeating this exercise the certificates might not update. You can work around this by first running.

sudo rm -f /etc/ssl/certs/[certificate-name].pem

where [certificate-name] matches the filename(s) of the certificates without the original (.crt) extension.

NOTE: Tested under Ubuntu 16.04, but I expect it will behave the same under 18.04.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.