Welcome to the Lounge

dandy722-Sep-21 3:47

dandy72

2-Sep-21 3:47

nepdev2021's response above (and harvyk0's below) both paint a much better picture than I could as for the how. Seems obvious in hindsight.

obermd1-Sep-21 9:22

obermd

1-Sep-21 9:22

Your client has apparently implemented a policy that eliminates most, if not all, of the trusted root certificates in their systems. It sounds like they're doing this by not allowing certificate chains to be processed at their firewall. My guess is they're either seriously paranoid, or they simply screwed up their firewall.

charlieg1-Sep-21 15:24

charlieg

1-Sep-21 15:24

I'm going to side on the seriously paranoid, but I do think they screwed something up. I spoke to a coworker, and he has no issue going to several suggestions I gave him. His PC is in the corporate domain. I'm a consultant, so my laptop is not in the domain. There might be some implications there.

Interestingly, I do have a VM that is in their domain, and it still has these errors. When I hear back from IT, I'll follow up this post.

Charlie Gilley
<italic>Stuck in a dysfunctional matrix from which I must escape...

"Where liberty dwells, there is my country." B. Franklin, 1783
“They who can give up essential liberty to obtain a little temporary safety deserve neither liberty nor safety.” BF, 1759

harvyk01-Sep-21 20:03

harvyk0

1-Sep-21 20:03

They have implemented SSL inspection on their Firewall (or Proxy).
Basically the connection is secure between the website you're visiting and their edge device but they failed to provide you with a copy of the root certificate used by their edge device.

Once you have the root certificate (and you actually trust the customers IT) then you'll cease getting that warning. At the same time however they have effectively man-in-the-middle attacked your connection, so what goes through that connection is a secret between you, the website your visiting, and your customer. Be wary of doing anything you'd actually want security for (eg Internet Banking).

GuyThiebaut1-Sep-21 20:19

GuyThiebaut

1-Sep-21 20:19

If I remember correctly in Chrome you can add the site to the HSTS ignore list: How to Disable HSTS in Chrome & Firefox | InfoSec Insights[^]

“That which can be asserted without evidence, can be dismissed without evidence.”

― Christopher Hitchens

Kiriander2-Sep-21 1:31

Kiriander

2-Sep-21 1:31

Can it be that the customer's IT department was so busy with doing stuff they can to stop & think about whether they should? I swear, most policies in my company stem from someone eager to make themselves noticed. Meaning making wind.

charlieg2-Sep-21 0:54

charlieg

2-Sep-21 0:54

Kiriander - not sure why your message would be flagged as spam, CP sent me the email notification. I know this customer is undergoing a couple of changes. There is a push to silo *everything* at corporate headquarters, so if you don't work there, you are rarely in the loop.

They are also paranoid to the extreme, as someone got into their network a couple of years back. They still refuse to talk about it, no details, etc.

Interestingly, the corporate policy is that you must open a ticket to receive IT support. About the only time I get a response on tickets is when I need my account unlocked. Ask a difficult question, and I rarely get a response. My feel is that they are severely overworked or understaffed - same difference. I only know the local folks.

milo-xml2-Sep-21 2:40

milo-xml

2-Sep-21 2:40

We have two things that interfere with our internet at my work. One is our network appliance that caches web pages locally for reuse. And the other is our web filter that blocks unwanted websites. Sometimes the SSL certs get screwed up if you're not logged in properly and that results in what I think you're seeing.

adudley2562-Sep-21 4:45

adudley256

2-Sep-21 4:45

Essentially they are logging/inspecting all traffic in the middle.

BROWSER -> Proxy/Firewall -> Internat Website

At the Proxy/Firewall side (it could be a IDS, IPS whatever) they are getting the data from the Internet Website, decrypting it, looking at it/storing it/ who knows, then passing the data on.

Now, part of SSL (TLS these days) is not just encryption/decryption, but WHO you are/which websites.

It is 'impossible', for your customer/Proxy to 'be' Lowes.com, so instead they re-encrypt the data with their own Certificate 'customerCA.com' for example, and say it's for the website 'Lowes.com'.

So, the browser knows this, and says, but you went to Lowes.com, but the SSL cert is Signed by CustomerCA.com ... I'm not showing you this website, it's been hacked/broken etc.

What everyone here means about 'installing the customer CA' is, that it's possible, to install 'CustomerCA.com' in a way, that makes it all ok for any website, so then when the proxy Generates new SSL Certificates on the fly/as you browse, for each website, your computer goes... yep, I trust CustomerCA.com, its all OK.... just like it does when it goes I trust LetsEncrypt CA, or VerisignCA etc.

HOWEVER, that being said, I wouldn't install that thing, don't do anything on that connection.

You want to setup your ROUTES on your system, so that only data for the customer's network goes via the VPN, and the rest goes via your 'standard' internet connection.

This way, you get to browse Lowes.com all day long, but still be connected to the vpn, and secure. It tells the PC to go to the VPN for some traffic, and to your standard 'internet' for other traffic.

The simplest way, it to tell the VPN adapter not to be your default gateway, but there are many ways to do this if you cant change it.

<a href="https://pasteboard.co/KiKBxAZ.png">https://pasteboard.co/KiKBxAZ.png</a>[<a href="https://pasteboard.co/KiKBxAZ.png" target="_blank" title="New Window">^</a>]

Dear Micro$oft,

Dan Neely1-Sep-21 4:26

Dan Neely

1-Sep-21 4:26

When I'm setting my default browser on a new Windows install, I don't need to check out Edge first.

If I'm on that settings dialog I've already confirmed Edge can still download other browsers for me.

Did you ever see history portrayed as an old man with a wise brow and pulseless heart, weighing all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius

charlieg1-Sep-21 4:42

charlieg

1-Sep-21 4:42

Irritating, aren't they?

Super Lloyd1-Sep-21 12:04

Super Lloyd

1-Sep-21 12:04

As a side note, I tried Edge at work.. and now it's my main browser at home! Big Grin | :-D

It's much like chrome.. but there is one specific feature that I quite like:

It show tabs that make sound / play video with a speaker icon in the tab, an you can click on it to shut them up! Poke tongue | ;-P

A new .NET Serializer
All in one Menu-Ribbon Bar
Taking over the world since 1371!

Kornfeld Eliyahu Peter1-Sep-21 19:45

Kornfeld Eliyahu Peter

1-Sep-21 19:45

Super Lloyd wrote:
speaker icon in the tab

As you told - just like Chrome (about 3 years)...

"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012

Super Lloyd1-Sep-21 22:11

Super Lloyd

1-Sep-21 22:11

Really?

You cannot stop the sound in chrome, I think.
Indeed I just tried (have the usual mass market chrome, no custom settings no addons), started chrome, went to youtube, clicked on the icon, music keeps playing Frown | :(

In Edge I can! Smile | :)

Very good against annoying popup video...

EDIT, oh I see, you have to right click, it's in the context menu! never though of right clicking on the tab until today! Blush | :O

Well it's easier with edge, a single click suffice! Poke tongue | ;-P

A new .NET Serializer
All in one Menu-Ribbon Bar
Taking over the world since 1371!

Kornfeld Eliyahu Peter1-Sep-21 22:51

Kornfeld Eliyahu Peter

1-Sep-21 22:51

Clearly we have differences between our Chrome...
I cannot paste an image here, so you have to believe me that I have that small icon there to indicate that the site playing sound, and I can stop it from there...
... just like here: https://www.techhelpkb.com/wp-content/uploads/2018/03/mute-sites-in-google-chrome-featured.png[^]

"The only place where Success comes before Work is in the dictionary." Vidal Sassoon, 1928 - 2012

Super Lloyd1-Sep-21 23:32

Super Lloyd

1-Sep-21 23:32

I am confused. One of us does not understand the other.
I read your message again, no luck.

So let me repeat my Chrome experience:
- 1. I have the icon too.
- 2. (left) clicking on it does nothing.
- 3. I have to right click the tab, which open a context menu, which has a mute option.

A new .NET Serializer
All in one Menu-Ribbon Bar
Taking over the world since 1371!

modified 2-Sep-21 5:39am.

Possibly off-topic, but ...

Dan Neely2-Sep-21 6:10

Dan Neely

2-Sep-21 6:10

Something about your Chrome is configured oddly. By default a left click on the icon should mute/unmute the tab.

OriginalGriff1-Sep-21 3:17

OriginalGriff

1-Sep-21 3:17

[1352] I Got Rick-Rolled Via Mail (Locking USB Drive) - YouTube[^]
It's worth reminding people just what comes with a USB connector these days, I think.

"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
"Common sense is so rare these days, it should be classified as a super power" - Random T-shirt
AntiTwitter: @DalekDave is now a follower!

Slacker0071-Sep-21 3:59

Slacker007

1-Sep-21 3:59

I love the LPL youtube channel. Been watching his show for a while now. I have not seen all of them, but a lot of them.

Nice.

Rick York1-Sep-21 5:38

Rick York

1-Sep-21 5:38

I didn't know the Lounge had a topic.

"They have a consciousness, they have a life, they have a soul! Damn you! Let the rabbits wear glasses! Save our brothers! Can I get an amen?"

OriginalGriff1-Sep-21 5:44

OriginalGriff

1-Sep-21 5:44

Well, I've had a few ...[^]