0

I've started seeing failing "Cisco Umbrella Secondary SubCA syd-SG" certs in all sorts of places suddenly when browsing. Safari, Firefox, Chrome on my 2 macs are both having this problem for various sites that all use the Cisco Umbrella Root CA.

My main source of non-technical news was what I first noticed... Missing images on theage.com.au site

https://static.ffx.io/images/$zoom_0.24609375%2C$multiply_0.8862%2C$ratio_1.5%2C$width_756%2C$x_0%2C$y_0/t_crop_custom/q_62%2Cf_auto/1a9b8a6c39d0b07f63b73f0cb5e0a69a5d15c50a untrusted cert for theage.com.au's static images

Then it's on the pan macmillan site as well...

missing images on panmacmillan.com site

https://ik.imagekit.io/panmac/tr:q-75,di-placeholder_portrait_aMjPtD9YZ.jpg,w-350,pr-true,bl/edition/9781509868605.jpg broken cert for the static image link

This is happening on safari, chrome, firefox on both my macs, and my ipad. doesn't seem to happen on my iphone. And i don't have a non-apple device at home...

What I'm really trying to find out is:

  • is this just me!??!
  • is this just on macs, and Apple hasn't updated its Root CA list? (It's not on their list of trusted Root CAs)
  • if it's just me, any idea how I fix this?

Thank you in advance!

1 Answer 1

2

... Apple hasn't updated its Root CA list?

The "Cisco Umbrella ..." CA's is not public CA trusted by default. It is instead a CA used for SSL interception by a security product (Cisco Umbrella) used within your company. Typically such CA are automatically rolled out to company managed devices, so that they get trusted. You should see this error only if you are using a non-managed device (like your private system) on the company protected network or if the automatic roll-out of the CA was not properly done. For help contact your company IT or see Install the Cisco Umbrella Root Certificate.

3
  • 2
    Warning: if you see this CA and you are not in a company/organization that uses Cisco Umbrella, then someone is using it to spy on you. You should not install it as a trusted CA without knowing why you're getting it, and being sure it's being used for legitimate purposes. Jul 2, 2022 at 17:39
  • Well, this is why I'm concerned. Of my two Macs, one has in the past, had Cisco AnyConnect on it. Which isn't meant to be tampering with my certs - but MAYBE it has. The other Mac though... That's never had any cisco products on it, so it shouldn't ever have had anything on it. BUT, the. confusing part for me... Why would an installed cert on MY computer - if that's the problem - be being exposed for other websites? Is there facility for something on my computer to replace the certs of public sites?
    – Jty.tan
    Jul 2, 2022 at 22:35
  • @Jty.tan:: Your internet connection is using Cisco Umbrella but the reason for this is unknown to use - nothing is known about your system, your environment, ... . Cisco Umbrella does SSL interception which l basically is a man in the middle "attack", only for legit reasons - i.e. to decrypt and inspect the traffic in order to protect against attacks. Such MITM will result in different certificates used for the connection since there is no longer an end to end encryption with the original server. Jul 3, 2022 at 1:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .