2

I recently installed a new BT HomeHub6 router for my household internet connection. It's been less than 24 hours, and I'm seeing a warning pop up on my desktop computer occasionally regarding Outlooks' connection to my exchange service, hosted at office365.

The error indicates that the certificate presented by the server (outlook.office365.com) is:

  1. Self-signed
  2. Does not have a subject that matches outlook.office365.com
  3. Is valid in terms of it's date

Diving deeper into the certificate, I can see that the self-signed certificate has the subject "CN=self-signedKey,O=Sagemcom Ca,C=FR". This is too much of a coincidence that I've just changed my router, and a router manufacturer is labeled in a certificate that's on an https session, in an attempt to MITM. Now this could be a MITM attack on a jump after my router (I don't think I have any way to investigate that), but browsing to the FQDN as a URL via my browser just redirects to the OWA login page, with no certificate warning.

It just seems scary to me that my router would even attempt to do a MITM or any sort of packet inspection with out my say-so. Or am I deeply naive?! Is this normal? Or am I alone?

Self-signed key error message.

Self-signed key error message.

Showing the Subject for the nasty certificate.

Showing the Subject for the nasty certificate.

It also occurs to me that my https session with outlook.office356.com is using a public key far larger in size than the crumby 1024bit one being presented, so infact it's degrading the security of the tunnel.

Other than clicking on "No", is there any way for me to categorically distrust this certificate so that the warning never appears again?

Improve this question
4
  • Enable error logging in the router and check its log next time it does that. Routers don't have intentions (good or bad), so they won't hack you on their own. You need to clarify exactly what request causes this and check relevant settings in the router (perhaps firewall or parental control rules).
    – Julie Pelletier
    Jun 26, 2016 at 16:30
  • Do you use BT's Safe Browsing thing to protect kids?
    – t1nt1n
    Jun 26, 2016 at 17:51
  • No, I don't have Safe Browsing turned on. And I've disabled the BT access control. Thanks for the suggestion though t1nt1n. Hmmm didn't think to look at the logs. At 14:35 it decided to reboot, and slurped some new firmware from pbthdm.bt.mo (sic). Odd. I wonder if during this reboot there was a default route to itself for all traffic which presented the self-signed certificate? Seems unusual rather than just dropping the packet/connection.
    – belial
    Jun 26, 2016 at 18:10
  • OK, my HH6 started doing other weird stuff (rebooting every 7 mins) so had BT replace it... only for the replacement to suffer with the same issue :/ My HH5 is fine though... suffice, I've been unable to get to the bottom of the SSL MITM issue. I'd like to think that once I do get my HH6 online again this will all have gone away. I'll update once I can confirm.
    – belial
    Sep 27, 2016 at 8:30

1 Answer 1

Reset to default
-1

I'm unable to comment due to low rep, but are you definitely sure you're using your private wifi, and not the FON/BTWifi connection? Sagemcom is the manufacturer of the HomeHub 6 and the software it runs, and I believe that for FON they use their own certificate for filtering. Also, see the answer here about DNS leaks. You may wish to change the DNS servers and try again. Finally, when accessing a site which has HSTS enabled (like Google Encrypted) see if you're blocked from accessing it.

Improve this answer
3
  • I'm actually connecting to the router via the wired network, not the WiFi. Besides which I have the BT FON (Which I think they call "BT WiFi" these days) is deactivated. I am able to access Google Encrypted. (HSTS was a good shout though) I may try manually setting OpenDNS tomorrow, to see if that remedies the issue.
    – belial
    Jun 26, 2016 at 20:56
  • Can I ask why my question was downvoted? I feel it was a fair call for information. and @belial I think DNS is a good bet. You could also try censurfridns.dk
    – dylan-myers
    Jun 27, 2016 at 9:52
  • Not sure why it was down voted either. Thanks for the suggestion of censurfridns.dk. I'll check it out
    – belial
    Jun 27, 2016 at 10:59

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .