Is Private Internet Access injecting their own Google cert?

#1

Post by vicken » Fri, May 22, 2015, 1:13 AM UTC

I noticed something really strange happen today. I'm getting an invalid certificate warning ("This certificate is not valid (host name mismatch") while sending email through Google's smtp server. I decided to disconnect from PIA and send the email and, low and behold, no certificate warning. I reconnected to PIA, tried to send a test email, and got the warning again.

Anyone else notice this? I've noticed this happen several times in the past, but I didn't pay much attention to it. The cert in question is for mx.google.com

Re: Is Private Internet Access injecting their own Google cert?

#2

Post by sharth » Fri, May 22, 2015, 1:55 PM UTC

What is "Private Internet Access"?

Re: Is Private Internet Access injecting their own Google cert?

#3

Post by wlkr » Fri, May 22, 2015, 2:00 PM UTC

sharth wrote: post #2

What is "Private Internet Access"?

A VPN service, https://www.privateinternetaccess.com/

Re: Is Private Internet Access injecting their own Google cert?

#4

Post by dangrossman » Fri, May 22, 2015, 3:48 PM UTC

> low and behold

It's "lo and behold". Lo is short for look (archaically loke).

Re: Is Private Internet Access injecting their own Google cert?

#5

Post by ammmir » Sat, May 23, 2015, 6:28 AM UTC

would you mind providing some details, such as, the hostname you're using (mx.google.com doesn't resolve), the exact error message, and if possible, the certificate chain you're seeing?

we absolutely are not injecting any certificates or otherwise modifying or inspecting traffic.

(disclaimer: i am an employee of PIA)

Re: Is Private Internet Access injecting their own Google cert?

#6

Post by vicken » Thu, May 28, 2015, 1:49 AM UTC

ammmir wrote: post #5

would you mind providing some details, such as, the hostname you're using (mx.google.com doesn't resolve), the exact error message, and if possible, the certificate chain you're seeing? we absolutely are not injecting any certificates or otherwise modifying or inspecting traffic. (disclaimer: i am an employee of PIA)

Sure thing, I snapped a shot of the error window when it popped up: http://imgur.com/y5tQbTn

I was connected to the US East server at the time.