3

Basically, my school is apparently having a network 'update' and are telling us to go to keychain access and trust a certificate. This is what they sent us.enter image description here enter image description here enter image description here Exactly what will happen if I do this any? Do you have any recommendations for what I should do?

  • Are you a student or a member of staff? Is this your personal computer or a device supplied by the school? – Graham Miln Aug 15 '18 at 12:40
  • Personal Computer – Just the Normal Mac User Aug 16 '18 at 0:44
2

Trusting a certificate gives the owner of that certificate the ability to limit security warnings when performing some tasks. These tasks include installing new software, and intercepting & proxying secure connections.

Whether you should follow the request to trust the certificate depends on who owns the computer.

See Should I let my child's school have access to my kid's personal laptop? for a related question over on the Information Security site.

School Device

If the computer is supplied by the school and the school want you to install their trusted certificate, then you should do so.

Personal Device

If this computer is yours, I would not trust their certificate. Adding an always trusted certificate is significant step and should rarely be needed on a personal device.

Minimum Trust

Note the sub-options in step 5:

Keychain certificate trust

You can choose to trust the certificate only for certain functions. If the certificate is intended to allow locally developed and signed software to run, then only Code Signing should be required. Maybe X.509 Basic Policy also.

I would avoid trusting Secure Sockets Layers (SSL) until it is proven essential. This trust would allow the school to intercept previously secure Internet connections.

You could incrementally trust/distrust parts the certificate until you found the minimum set of trust required.

  • I’d second this. But I believe the school is deploying some internal application and has saved on getting a certificate from a trusted third party. The app has created its own certificate and hence require trusting. – Nimesh Neema Aug 15 '18 at 12:45
  • 2
    I do not want to assume the reason why. We do not know the owner of the device or the intent of the certificate. – Graham Miln Aug 15 '18 at 12:46
  • I also found it suspicious as they gave us only a week to do it – Just the Normal Mac User Aug 16 '18 at 0:54
  • Would SSL stop VPNs from working at school? – Just the Normal Mac User Aug 16 '18 at 3:22
  • Your VPN would continue to work. However, your VPN software would always trust the school's certificate for SSL/TLS and thus the school can undermine the security of connections via the VPN. – Graham Miln Aug 16 '18 at 6:48
0

Personally, I’d say no. This is an intermediate CA (and below that a Root CA). This enables the owner of that CA to man in the middle your connections. There is no reason to accept such a CA unless there is a large volume of internal applications. The general application of a CA like that is for SSL man in the middle boxes that do traffic inspection — often badly configured.

  • Is it possible that they are trying to look for hackers on the network – Just the Normal Mac User Aug 16 '18 at 0:51
  • Possible, this would be a crappy way to try to do that – John Keates Aug 16 '18 at 2:19

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .