hambier2d ago

When has it become normal practice to intercept (as in #MitM attack!) connections secured by a #letsencrypt certificate? That's outrageous!

For years and years I didn't have a single such issue with my selfhosted service, but recently I had the "pleasure" - twice! - to deal with such malicious networks. It's beginning to be a huge annoyance. (Some of my services are relevant for my work.)

Do we have to go back to paid certificates??

#selfhosting #cybersecurity #TLS

Show threadDaniel Lakeland2d ago
@hambier
How exactly did you think this was accomplished? I dont understand what youre claiming? are you saying the root certs are compromised?
Show threadhambier2d ago
@dlakelan I'm saying that the browser is throwing the typical scary warnings and when inspecting it's not the certificate that my server is actually presenting, but rather one issued by Fortinet or some other corporate security software that has been substituted for it.
Show threadTaasz/Woof

@hambier @dlakelan I see what you mean, this isn't anything to do with letsencrypt at all, but instead whatever firewall/security appliance you are connecting through is doing MITM on SSL connections.

This is common with businesses and sometimes school networks too. Not much you can do about it other than use a different network.

Mar 25 at 2:39pmWeb