Fed Up Of Installing Certificate On BYOD Devices

[Fazza]

We have several different web filtering levels, Guests, Staff, Students (6th Form Only) etc. and I'm getting fed up with having to email across the surfprotect.crt certificate from EXA Networks to mobile phone users and copying it from a USB memory stick to laptops in order to get a BYOD to be able to access the internet.

 

Not everyone has a contract phone, some have PAYG with no credit on so trying to get a certificate emailed to that device is a non-starter and it's very embarassing when we have guests from different organisations around the country come to visit and ask for the Guest WiFi password which wont actually get them on to the internet until we've explained that we're not installing anything dodgy on their devices when we try and get the certificate installed!

 

We've spoken to Exa on the phone and they said there is no other way - but surely there's gotta be a way of getting the certificate installed on their BYOD devices than this??

[Meldrew]

Our filtering system, Censornet, provides a link available on the guest network to download the certificate. There are still problems installing this, especially on Apple devices where you have to change settings to get the certificate installed as a root certification authority to get it working, but it does work. Can you emulate this by setting up a tiny webserver (a Rasperry Pi, even) on the guest network where you could host the certificate file?

 

Meldrew

[DJ-1701]

Unfortunately this is a shortcoming of SSL filtering. You can install a captured portal to redirect web traffic to a certain webpage first, but if the page they try to get to is HTTPS, they are going to get that untrusted message.

 

What I have done is put it under the view of people have to read an agreement to use the web for personal use, and they have that they get instructions to go to http://byod/ which hosts a webpage to access and install the certificate, which has a brief explanation on there why it is needed.

[Fazza]

Our filtering system, Censornet, provides a link available on the guest network to download the certificate. There are still problems installing this, especially on Apple devices where you have to change settings to get the certificate installed as a root certification authority to get it working, but it does work. Can you emulate this by setting up a tiny webserver (a Rasperry Pi, even) on the guest network where you could host the certificate file?

 

I guess so but I'm not a web developer so no idea how to create a web page that will have the certificate on it so they can install it etc.

 

 

What I have done is put it under the view of people have to read an agreement to use the web for personal use, and they have that they get instructions to go to http://byod/ which hosts a webpage to access and install the certificate, which has a brief explanation on there why it is needed.

 

That sounds like the sort of thing we need!

[SchoolsBroadband]

You could take a decision not to do SSL inspection on your BYOD network. Yes use a captive portal for auth so you know who is who but you could take the decision not to decrypt everything for ease of use.

 

Dave

[DJ-1701]

You could take a decision not to do SSL inspection on your BYOD network. Yes use a captive portal for auth so you know who is who but you could take the decision not to decrypt everything for ease of use.

 

Dave

 

Little easier said then done though isn't it? The transparent proxy is using SSL inspection as provided. I guess Exa might be able to change the transparent proxy with a bit of work for a certain IP range, though as another ISP provider you would know better than I.

 

Though, I will say as people are moving over to SSL websites, plain old http filtering by itself will become less useful over time and let things slip through the net.

[SchoolsBroadband]

I don't know Exa's system well enough to comment on what you can and can't do with it. I can tell though you can on Fortigates, Lightspeed and Netsweeper all when in transparent mode as you do a policy to an interface or an IP range.

 

If you're on a proxy based solution (as we currently are on Netsweeper) then we just create another port on the proxy for BYOD networks and set that to not decrypt if that's what a customer wants. Easy....

 

Good luck @Fazza

 

Dave

[MartinT]

You could take a decision not to do SSL inspection on your BYOD network. Yes use a captive portal for auth so you know who is who but you could take the decision not to decrypt everything for ease of use.

Then you'd be ignoring all the safeguarding rules for keeping children safe. No way would I not decrypt/inspect.

 

By the way, to answer the o/p, our Smoothwall presents the certificate on a web page for easy downloading. I wish I could tie it in to the block message, but that'll be the next step.

[IrritableTech]

Little easier said then done though isn't it? The transparent proxy is using SSL inspection as provided. I guess Exa might be able to change the transparent proxy with a bit of work for a certain IP range, though as another ISP provider you would know better than I.

 

Though, I will say as people are moving over to SSL websites, plain old http filtering by itself will become less useful over time and let things slip through the net.

 

Removing ssl inspection doesn’t necessarily prevent you from filtering ssl sites. Most filters can still block or allow based on the certificate or SNI, but you can’t for example block https//Twitter.com and allow https://Twitter.com/MrAdamWelch when you don’t fully inspect.

 

There is an issue with some shared certificates, but it’s not a problem for the vast majority of ssl sites.

[DGardiner]

Removing ssl inspection doesn’t necessarily prevent you from filtering ssl sites. Most filters can still block or allow based on the certificate or SNI, but you can’t for example block https//Twitter.com and allow https://Twitter.com/MrAdamWelch when you don’t fully inspect.

 

There is an issue with some shared certificates, but it’s not a problem for the vast majority of ssl sites.

 

it would disable content-aware filtering efforts though. its ok though because i had an IT "Expert" tell me the other day we should be using dns filtering as DPI interferes with things too much

[pete]

Then you'd be ignoring all the safeguarding rules for keeping children safe. No way would I not decrypt/inspect.

 

I assume if the visitor isn't allowed to authorise third parties to install interception certs on their company-issued device, you've got a stack of laptops for them to borrow?

 

I (for example) would be breaching our AUP and data protection policy if I allowed another organisation to intercept secured traffic from my school devices.

[MartinT]

I should have explained. We use BYOD for our staff and students' own devices. Visitors can use the guest system which filters lightly and doesn't inspect.

[IrritableTech]

Different decisions are likely to be made for different users. We don’t have a safeguarding responsibility for most visitors, but we may still have a prevent duty. Staff and sixth form BYOD will be different.

 

A landing page after authenticating to the Wifi is the most sensible option and the one we’re likely to go for shortly. I’m interested in developing a page which adapts to the device (well the reported browser) so the instructions are device specific straight away as much as possible.

[kidpressingbuttons]

We have an internal web server running wordpress that we upload the cert and AUP. They get redirected to it when joining the BYOD network. Edited May 30, 2018 by kidpressingbuttons

[gshaw]

SSL inspection is a tough one, on one hand the web basically goes dark as far as filtering is concerned without it but the amount of issues also make it difficult...

 

- devices are increasingly naggy about installing root CAs e.g. Android persistently warns about the security of the device once a certificate is installed, thus users feel "spyware" has been installed on the device

- some apps break once MITM SSL inspection is turned on = poor BYOD user experience

 

We SSL inspect on domained devices but BYOD puts us in a difficult place.

[TechMonkey]

Visitors can use the guest system which filters lightly and doesn't inspect.

 

Can I ask how you prevent pupils signing on to the guest system to access things they are filtered from on the student network?

[Davit2005]

I guess so but I'm not a web developer so no idea how to create a web page that will have the certificate on it so they can install it etc.

 

 

 

That sounds like the sort of thing we need!

 

I simply put a hyperlink to the cert on the captive page then pointed this to the cert file on a web server they could get to.

[EXA_Mark]

We have several different web filtering levels, Guests, Staff, Students (6th Form Only) etc. and I'm getting fed up with having to email across the surfprotect.crt certificate from EXA Networks to mobile phone users and copying it from a USB memory stick to laptops in order to get a BYOD to be able to access the internet.

 

Not everyone has a contract phone, some have PAYG with no credit on so trying to get a certificate emailed to that device is a non-starter and it's very embarassing when we have guests from different organisations around the country come to visit and ask for the Guest WiFi password which wont actually get them on to the internet until we've explained that we're not installing anything dodgy on their devices when we try and get the certificate installed!

 

We've spoken to Exa on the phone and they said there is no other way - but surely there's gotta be a way of getting the certificate installed on their BYOD devices than this??

 

Hi @Fazza

 

Sorry for the delay in replying, I've just got back from a meeting, and have been out of the office all day.

 

I think there may have been a bit of confusion in house on this, or at least a misunderstanding on what you wanted to do. I shall take this up with the Support Manager in the morning to make sure all of the team are aware that you can simply get the SurfProtect certificate by going to the webpage which is hosted at exa.is/certificate so if you send that link to users they’ll be able to download it directly from there, rather than emailing or copying it over.

 

Unfortunately, enacting SSL filtering means that the certificate does need to be installed onto each user’s device if they would like to decrypt all sites rather than just HTTP domains, which is something I would strongly recommend, whilst you could avoid HTTPS filtering (as a few others have mentioned), this is not in line with DfE guidelines.

 

We are always looking for less invasive ways of doing the decryption, but for now, you do have to install them, which I know can be time consuming, but hopefully sending people to the link, will hopefully speed things up a bit.

 

Hope this helps but if you need anything else just let me know.

[AlanD]

You could take a decision not to do SSL inspection on your BYOD network. Yes use a captive portal for auth so you know who is who but you could take the decision not to decrypt everything for ease of use.

 

Dave

 

..you could....and then get sacked for not meeting the requirements of the prevent strategy in schools....which if

Focus on being able to report on ...for example web searches...which would be invisible without ssl inspection.

 

Schools are not being asked to do things for the sake of “ease of use”.....

 

You might meet those requirements by using other means to monitor what is being done on BYOD ...but doing that would always mean something being installed...

[SchoolsBroadband]

Yes I don't disagree with that. To be clear it's not our policy to install filtering without ssl decryption as standard because of the issues you highlight.

 

Some schools have turned this feature off themselves or asked for it to be turned off. We do not dictate policy on this but give schools the tools to setup their filtering as they see fit.

 

Dave

Dave

[free780]

Android 7+ won't trusted user installed certificates which breaks interception. There was a large thread a few months on the Smoothwall section. If Apple go the same way maybe interception will be a thing of the past unless legislation is passed to add a system root for filters to these devices.

[FN-GM]

We don't HTTPS inspect the guest wireless. One of the schools just got Outstanding in all areas including Safeguard.

[Steve21]

We don't HTTPS inspect the guest wireless. One of the schools just got Outstanding in all areas including Safeguard.

 

Is that guests though or students? Prevent isn't about random adults visiting

 

Steve

[FN-GM]

Is that guests though or students? Prevent isn't about random adults visiting

 

Steve

 

Guest network. Is it in response to someone previously mentioning the guest network.

[Steve21]

Some schools use the segregated "guest" one for everyone though (non-domainy wise) so that's different to whether it needs inspection etc. But in your example yeah there's no reason that shouldn't get a good mark

 

Steve