6

I want to install a configuration profile to automatically connect to my university network but along with the two wifi network configurations there are also two certificates, their description is "AC du fournisseur d'identité" (in English: CA of the identity provider), those are certificates "TERENA SSL CA 3" and "DigiCert Assured ID Root CA", both emitted by "DigiCert Assured ID Root CA".

What is the exact impact of this on the security of my system ?

Does it only sign the profile or does it install new trusted certificate emitters for the websites I can consult for instance ? (which would augment the risk of man in the middle attack)

Thank you

2
+50

The file eduroam-OS_X-UdS.mobileconfig contains five certificates. Three of them can be retrieved by entering openssl pkcs7 -inform DER -print_certs -in ~/Downloads/eduroam-OS_X-UdS.mobileconfig.

At least two of the three belong to the chain of trust to validate code signing of the mobileconfig file.

You can verify this by clicking on verified

enter image description here

enter image description here

The other two ("TERENA SSL CA 3" and "DigiCert Assured ID Root CA") are the chain of trust to validate the identity of your university's RADIUS server. By opening eduroam-OS_X-UdS.mobileconfig with a decent editor you can see and extract them. By saving each of them as a *.cer file you can compare and validate them yourself by opening them with Keychain Access.app: choose one of the two certs and right-click it > evaluate cert > Generic.

enter image description here

If the TERENA cert isn't evaluated successfully it doesn't catch the Digicert root certificate properly. Simply hit the button Go Back and repeat the step.

"DigiCert Assured ID Root CA" is a duplicate of a certificate already existing in your System Roots keychain and "TERENA SSL CA 3" is an intermediate certificate authority. Both are required to ensure the identity of the Radius server. If possible you should choose to "Validate the (RADIUS) Server Certificate" though. I don't know (and haven't been able to find) the DNS-name of your university's RADIUS server.

None of the certificates lower your system security. If everything is properly configured (especially on the server-side) an MITM shouldn't be possible: Security Considerations.

If something is configured improperly and you are a victim of an MITM your l'identifiant E.N.T and le mot de passe E.N.T will be "lost".

0

If your place has a proxy with 'ssl-inspection' (aka mitm) then if you surf to https://bank.com this proxy would be the 'Issuer' of the server certificate that you see, and it would be the client if you ask bank.com. You should be able to see this easily when you click the button for the cert in the browser, look for the Issuer field, but validate the fingerprint (compare to the one you installed). If you use Firefox you will get a warning because that has its own store for CA root certificates. Ironport is a brand of proxy appliances that can do this, sometimes you'll see this name in the CA roots. In Windows Internet Explorer, these can be pushed by policy.

-2

I think your question is a VERY GOOD ONE and also a very wide scope of what can be effected. So first what components can be in a profie:

And according to APPLE: A configuration profile contains a number of settings that you can specify, including:

Restrictions on device features Wi-Fi settings VPN settings Email server settings Exchange settings LDAP directory service settings CalDAV calendar service settings Web clips Credentials and keys

I say your question is wide scope because those plus more can be modified and I'm certain have many items to be configured

HERE IS EVERYTHING APPLE HAS TO SAY ON IT: https://developer.apple.com/library/prerelease/content/featuredarticles/iPhoneConfigurationProfileRef/Introduction/Introduction.html#//apple_ref/doc/uid/TP40010206-CH1-SW4

My take is you need to decipher the profile first and see what has been set....

  • I'm not entirely sure that there is an answer here other than just a cursory glance of what security settings there are; as such, I think this would be better off as a comment. – Allan Feb 1 '17 at 0:26

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .