Site is "not secure" when on school internet, but fine on other internets.

[Kazuhiko-Gushiken]

Select Topic Area

Question

Body

Below are the two certificates when on both internets. The one that shows by Fortinet is when on school internet. The other is when on hotspot/home WIFI. My other websites ending in .com work fine, but with .dev it fails. Anyone know what's going on and how to fix?

Extra Info:

• There's only a CNAME file and a (mostly) blank index.html.
• I'm using Namecheap for where I got my domain name.
• HTTPS is enabled in Pages Settings

[StephDC]

Your school's Fortigate Firewall is trying to intercept and inspect the page you are trying to view. However for apparent reason they do not possess the original certificate, so the only thing they could do is to send you their certificate, and hope you accept it. That way your communication would go directly to the firewall and then be forwarded to your original server.

Personally, I would not trust such certificate as there would be no way for you to distinguish between a legit firewall and a MITM intruder. I also would not trust them to take good care of my own data that should be a private conversation between the server and me. Contact your IT department to try to add your domain to their firewall whitelist, or use a VPN or something to access your stuff.

[Kazuhiko-Gushiken]

@StephDC Hello, it ended up working last night (PST) out of no where. It properly shows the default github pages certificate and the like. There's absolutely no personal information on the website, currently there's only a meme splattered across the main page cause i was messing with a friend. If it happens again, I'll be contacting my school's IT department. Also, VPN doesn't work on school internet. As soon as I enable it, internet all together gets cut off.

[LiteBrite82]

Can you provide a link to your repo?
Are there any links to external sources in your code that are http, not https?
What does the web browser console say?

[StephDC]

This is completely irrelevant.

Such issue happens when the client (computer browser) attempts to establish a TLS connection to the server, thus repo is irrelevant.
Web console is also irrelevant because it happens before we get to the HTTP.

If the website is accessed through HTTP (sans TLS), the Fortigate firewall would happily inspect all of the contents and do whatever they want. However the following issues follow:

• Not only the firewall, but everyone en route to the web server could see and modify all communications in between without the other side knowing it.
• There are a lot of browser API (e.g. Crypto) that would simply not work in HTTP without TLS, to protect the client.

Browser -> DNS -> TCP -> TLS (Fortigate Router Firewall replaced the certificate) -x-> HTTP

[LiteBrite82]

@StephDC , Good to know, thanks for sharing! My security skills need some work; I'm mainly into coding, debugging, and basic deployments.

@Kazuhiko-Gushiken , are you hosting the site on GitHub Pages?

[Kazuhiko-Gushiken]

@StephDC , Good to know, thanks for sharing! My security skills need some work; I'm mainly into coding, debugging, and basic deployments.

@Kazuhiko-Gushiken , are you hosting the site on GitHub Pages?

I am using GitHub Pages. It actually randomly started working yesterday night (PST). I have no idea why or what happened.

[LiteBrite82]

@Kazuhiko-Gushiken Odd. I'm glad you got it working! I had a similar issue with setting up a React portfolio in GH Pages with a Domain Name I purchased on bluehost years ago. I never did figure the settings out between bluehost and GH Pages. I ended up deploying on Heroku.

Tangent: I used Create-React-App to build the portfolio; Heroku stopped supporting it; now I have to refactor it to Vite or something like it. I may try GH Pages again - your post has inspired me to keep doing hard things. Cheers!