3

My employer, the University of Texas at Austin (UT), requires devices running some operating systems* to accept a certificate before they connect. Information about the certificate is available here:

https://management.pna.utexas.edu/howto/

After I accepted the certificate on my iPhone, I looked at the certificate settings (Settings > General > About) and didn't see any certificates listed, and I wasn't required to enter my iPhone's password, so I don't think I installed a root certificate. My questions are:

  • Did I do anything other than trust that the WiFi network that I connected to is official University of Texas at Austin WiFi?

  • Will the UT network be able to perform Man in the Middle attacks on HTTPS/SSL encrypted sites without setting off an "Invalid Certificate" warning**?

  • Are there any other services (perhaps VPNs) that the UT network could spoof without setting off a certificate warning?

*So far, my iPhone requires me to accept the certificate but my Chromebook does not.

**They could perform a MitM attack on HTTP sites, but that's true to any WiFi network regardless of whether I accept a certificate.

Ender Wiggin
  • 905
  • 1
  • 6
  • 7
  • 4
  • No. 2. No. 3. Err, yes, e.g. an unencrypted service like DNS or HTTP won't show you a certificate warning. Guess this is not what you're really asking for.
    • – ximaera Jan 28 '18 at 23:15