Notices by Chuso Pérez (chuso@fosstodon.org)

I'm getting a warning when I try to access https://prod-ec-us-east-1.video.pscp.tv about an untrusted certificate valid for 10 years issued by Allot to Allot, which seems to be an Israeli company that does DPI among other things.

When I try to access the same domain name from one of my VPSs, I get a 1-year valid certificate issued by DigiCert to Twitter (which is the real owner of the domain name).

From both places, the domain name resolves to the same IP address.

Am I being MITMed by my ISP??

#Infosec #DPI

I know there are various reasons why you may end up connecting to different hosts when you access the same IP address from different locations, but I find it suspicious that from home I get a certificate issued from Allot to Allot for 10 years.

@mike805 Well, if you see the screenshot, I was using OpenSSL for the checks. There is no AdBlock for OpenSSL 😄
But it seems this Allot certificate is typically found when ISPs need to MITM your connection to enforce some blocks from court orders or similar: https://fosstodon.org/@chuso/111098873754183761

Now I wonder what they needed to block in one specific Periscope server.