Via @darkk, there are reports that ISPs in Kazakhstan have today (2019-07-18) begun to MITM TLS connections and instruct users to install a custom root cert. This is something that the government of Kazakhstan had threatened in 2016, but not followed through upon until now.
There is a Firefox ticket with links to more information.
Since today all Internet providers in Kazakhstan started MITM on all encrypted HTTPS traffic.
They asked end-users to install government-issued certificate authority on all devices in every browser: http://qca.kz/
Actual results:
MITM attack: https://i.imgur.com/rFEjXKw.jpg
Message from Internet provider, requires to install this CA: https://i.imgur.com/WyKjOug.jpg
Proofs: https://atlas.ripe.net/measurements/22372655/#!probes
Official site with root CA: http://qca.kz/
Links to certificates:
http://qca.kz/qazca.cer
http://qca.kz/qazca.pem
http://qca.kz/qazca.der
Archive of certificate download site: https://web.archive.org/web/20190718174154/http://qca.kz/
Copy of certificate files, downloaded by me just now: qazca-20190718.zip
Cached images from imgur:
Via @darkk, there are reports that ISPs in Kazakhstan have today (2019-07-18) begun to MITM TLS connections and instruct users to install a custom root cert. This is something that the government of Kazakhstan had threatened in 2016, but not followed through upon until now.
There is a Firefox ticket with links to more information.
Archive of certificate download site: https://web.archive.org/web/20190718174154/http://qca.kz/
Copy of certificate files, downloaded by me just now: qazca-20190718.zip
Cached images from imgur:
