You are not logged in. Your edit will be placed in a queue until it is peer reviewed.
We welcome edits that make the post easier to understand and more valuable for readers. Because community members review edits, please try to make the post substantially better than how you found it, for example, by fixing grammar or adding additional resources and hyperlinks.
Required fields*
-
10I'm no expert on this, but want to clarify this sentiment: "Logically, it appears that a MITM attack is possible". It's not just possible, it's the entire point of them installing this onto your computer. So no need to be paranoid, just understand what it is they're doing so you can safely work within their rules. I worked at a company in the US which had us install their own certificates as well.aaaaaa– aaaaaa2025-12-04 16:44:17 +00:00Commented Dec 4 at 16:44
-
3@aaaaaa The fact that the certificates do not set Name Constraints means that they're definitely not putting any effort into dispelling concerns... In this case, it probably is the point, but an organization making you install a root CA is not always done to make MITM possible.forest– forest2025-12-05 05:54:02 +00:00Commented Dec 5 at 5:54
-
1@aaaaaa It's not necessarily the entire point of the install of the certs. They could have legitimate certificates for actual websites that track back to those certs. We can't rule out that they want those certs for MITM, but we can't infer that it is their goal. If OP can still access any site with a regular certificate without installing those root certs, it's unlikely there is (currently) any generalised MITM in operation.jcaron– jcaron2025-12-05 11:35:14 +00:00Commented 2 days ago
-
1Resources disputing goverment decisions are easily blocked. In Russia, methods to circumvent blocks are outlawed, and sites disseminating them are blocked.Basilevs– Basilevs2025-12-05 18:47:38 +00:00Commented 2 days ago
-
1Kazakhstan does this because Kazakhstan intercepts your traffic and modifies it - maybe not right now, but they can when they want to. I don't think the question nor the answer need to be very long. If you don't install the certificate, they will still intercept and modify your traffic when they want to, but your computer will know it's wrong and won't load the page.Stack Exchange Broke The Law– Stack Exchange Broke The Law2025-12-06 17:43:21 +00:00Commented yesterday
|
Show 2 more comments
How to Edit
- Correct minor typos or mistakes
- Clarify meaning without changing it
- Add related resources or links
- Always respect the author’s intent
- Don’t use edits to reply to the author
How to Format
-
create code fences with backticks ` or tildes ~
```
like so
``` -
add language identifier to highlight code
```python
def function(foo):
print(foo)
``` - put returns between paragraphs
- for linebreak add 2 spaces at end
- _italic_ or **bold**
- quote by placing > at start of line
- to make links (use https whenever possible)
<https://example.com>[example](https://example.com)<a href="/api/flow.js?q=https%3A%2F%2Fexample.com">example</a>
How to Tag
A tag is a keyword or label that categorizes your question with other, similar questions. Choose one or more (up to 5) tags that will help answerers to find and interpret your question.
- complete the sentence: my question is about...
- use tags that describe things or concepts that are essential, not incidental to your question
- favor using existing popular tags
- read the descriptions that appear below the tag
If your question is primarily about a topic for which you can't find a tag:
- combine multiple words into single-words with hyphens (e.g. web-application), up to a maximum of 35 characters
- creating new tags is a privilege; if you can't yet create a tag you need, then post this question without it, then ask the community to create it for you