Solved

Trying to figure out Facebook SSL errors

Posted on 2014-10-13
17
255 Views
Last Modified: 2015-04-07
Hi everyone,
On my corporate network, when I go to facebook.com, I'm getting SSL certificate security errors: NET::ERR_CERT_AUTHORITY_INVALID.  See attached.

When I look at the Certificate info, I see the info in the second attached screenshot. It looks like the certificate is being issued by our security software (Trend Micro).

Also of note, there aren't any restrictions on Facebook access, so it's not a permissions issue.

I'm trying to make sense of this. Can anyone shed some light on what the issue may be? Thanks in advance.
cert-error.png
cert-info.png
0
Comment
Question by:isaacr25
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 7
  • 3
  • 2
  • +3
17 Comments
 
LVL 12

Assisted Solution

by:Chris
Chris earned 166 total points
ID: 40377254
Do you use any kind of inline web filter? In order to check the content on an SSL site, I've seen some web filters essentially perform a man in the middle attack on the SSL connection and the original site's certificate gets replaced by one generated by the filtering appliance.
0
 
LVL 35

Assisted Solution

by:Kimputer
Kimputer earned 166 total points
ID: 40377316
This is normal behaviour if you enable the deep scan / https scan in Trend Micro Web Security suite. That's because if you have it on, it's the only way to scan the https traffic. If it's the original certificate that Facebook uses, it means the connection is secure, and the content cannot be scanned. The only work around is that Trendmicro gives you the certificate, scans the content, and passes it on to Facebook (or any other https site).
0
 

Author Comment

by:isaacr25
ID: 40377347
Is this behavior necessary? While I am an advocate of security, this is making Facebook unusable, and it is next for some business functions.

What's the difference between this cert issue and other ssl sites that are not experiencing this behavior? Is the Facebook cert not sufficient? Trying to understand...
0
Enterprise Mobility and BYOD For Dummies

Like “For Dummies” books, you can read this in whatever order you choose and learn about mobility and BYOD; and how to put a competitive mobile infrastructure in place. Developed for SMBs and large enterprises alike, you will find helpful use cases, planning, and implementation.

 

Author Comment

by:isaacr25
ID: 40377350
I meant to type that Facebook is necessary for business functions. Sorry.
0
 
LVL 6

Expert Comment

by:Wylie Bayes
ID: 40377366
0
 
LVL 35

Expert Comment

by:Kimputer
ID: 40377405
All the sites that are scanned by Trendmicro have this behaviour. If you don't want it, disable https scanning. As I said, this is normal behaviour if you enable it, as I also explained earlier.
0
 

Author Comment

by:isaacr25
ID: 40377505
Kimputer
I can go to other sites via https without this behavior occuring. Does that mean that Trend is not set up to scan these sites? Again just trying to understand.

It is also being explained internally as being a SHA256 issue related to Google deprecation in January 2015. Doesn't make sense to me, but is there any validity there?
0
 
LVL 35

Expert Comment

by:Kimputer
ID: 40379483
Sites via https that do NOT have this behavior, clearly means it's NOT being scanned (check if certificate is valid just to be sure). TrendMicro has either an active filter for facebook and not this site, or the otherway around (filter all sites, with a whitelist exception for the ones that don't have this behaviour).
It's just like physics, if something falls, it's because of gravity. If you see this Trendmicro certificate, it's because it's being scanned. If not, it's not being scanned. The active rules, you have to check yourself, or with your IT Admin.
0
 

Author Comment

by:isaacr25
ID: 40380854
Kimputer
I can go to other sites via https without this behavior occuring. Does that mean that Trend is not set up to scan these sites? Again just trying to understand.

It is also being explained internally as being a SHA256 issue related to Google deprecation in January 2015. Doesn't make sense to me, but is there any validity there?
0
 

Author Comment

by:isaacr25
ID: 40380858
Ignore that last post. Sorry. I'm following up on my end in regards to your last post. Thanks.
0
 
LVL 70

Expert Comment

by:Merete
ID: 40385925
Have you looked in the padlock permissions / connections etc on the Facebook page, just a side idea
Facebook security permissions
0
 
LVL 32

Accepted Solution

by:
aleghart earned 168 total points
ID: 40398180
The HTTPS monitoring uses a man-in-the-middle technique.  The content from the requested site is decrypted, analyzed, then re-encrypted with an SSL cert belonging to the analysis device/server.

The problem you have is that your browser is not accepting the substituted SSL cert.  Your browser is correctly detecting that the encrypted traffic is not using a cert that matches the host sending the data.

This is usually fixed in corporate environments by pushing out a group policy that trusts the SSL cert of the man-in-the-middle device.

Your I.T. department would do that for Internet Explorer (and Chrome).  For Firefox (which doesn't use I.E.'s settings), you might have to tweak it manually.

Have you talked to your I.T. team yet?
0
 

Author Comment

by:isaacr25
ID: 40425082
I'm in discussion with the I.T. team now.

The confusing thing is that it seems to be selective. The issue is only happening for Social Media sites (Facebook, Twitter, LinkedIn). On any other site with https (like https://google.com), everything works fine.
0
 
LVL 32

Expert Comment

by:aleghart
ID: 40425487
Content filters can be (and often are) configured with a pass-through list.  This recognizes a domain or URL pattern an bypasses the HTTPS decryption stage.  It leaves the encryption intact.

Social media sites are a category that's often set to 'monitor' or 'warn' or 'block'.  To show a warning or block page, the traffic must be decrypted, which uses the substitute (or man-in-the-middle) SSL cert.

Same goes for monitoring.  The stream must be proxied to the web server, then re-encrypted before delivering to your browser.  Requires the substitute key.
0
 

Author Comment

by:isaacr25
ID: 40504010
Still in talks with IT. Should be able to close this question soon.
0

Featured Post

Defend Your Organization from The Greatest Threats

Looking to fill the gaps in your security? Bring together information from the network, endpoint and threat intelligence feeds to really see what's happening in your organization. Join the WatchGuardians in their adventures fighting cyber crime!

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

This article describes my battle tested process for setting up delegation. I use this process anywhere that I need to setup delegation. In the article I will show how it applies to Active Directory
Many businesses neglect disaster recovery and treat it as an after-thought. I can tell you first hand that data will be lost, hard drives die, servers will be hacked, and careless (or malicious) employees can ruin your data.
Sending a Secure fax is easy with eFax Corporate (http://www.enterprise.efax.com). First, just open a new email message. In the To field, type your recipient's fax number @efaxsend.com. You can even send a secure international fax — just include t…
Nobody understands Phishing better than an anti-spam company. That’s why we are providing Phishing Awareness Training to our customers. According to a report by Verizon, only 3% of targeted users report malicious emails to management. With compan…

752 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question