1

This article expose how around 18% of HTTPS connections are being detected as intercepted by MITM proxies. As the great related paper state:

To circumvent this validation, local software injects a self-signed CA certificate into the client browser’s root store at install time.
[...]
Contrary to widespread belief, public key pinning [19]— an HTTPS feature that allows websites to restrict connections to a specific key— does not prevent this interception. Chrome, Firefox, and Safari only enforce pinned keys when a certificate chain terminates in an authority shipped with the browser or operating system. The extra validation is skipped when the chain terminates in a locally installed root (i.e., a CA certificate installed by an administrator) [34].

Is pretty common on companies, desktop antivirus and malware/adware to add root CA. Sometimes even with honest reasons. But to make the situation more clear: SSL web browsing is exactly as strong as the weakest CA.


I wan't to check if my HTTPS traffic is intercepted at least in three aspects (better if just with CLI):

How to list unofficially installed CA certificates (doesn't came with Ubuntu/Firefox/Chrome) to avoid MITM attacks/HTTPS interception?
How to reset trusted certificates stores to its default?

Some research

  • checkmyhttps seems old and not trustworthy
  • Chrome: I'm not sure if chrome://settings/certificates is a subset of what return some of this commands:

    awk -v cmd='openssl x509 -noout -subject' '/BEGIN/{close(cmd)};{print | cmd}' < /etc/ssl/certs/ca-certificates.crt  # System wide I
    trust list  # System wide II
    certutil -L -d ~/.mozilla/firefox/*.default*/  # For Firefox
    
  • I already sudo update-ca-certificates -v -f but I'm not jure if it just update without removing any sneaky installed certificate.

Reference

  • 1
    Firefox and Chrome come with their own certificate store which is independent from /etc/ssl/.... The latter is used by other tools like curl but some applications, libraries or tools come with their own CA store (Java, python requests ...). So it is not really simple to check all of these. – Steffen Ullrich Mar 28 at 5:28
  • @SteffenUllrich I didn't say it would be easy, and as you know is not rare. There are already some answers for Windows and Red Hat out there. – Pablo Bianchi Mar 28 at 17:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.