How DNS Filtering Intercepts SSL/TLS Traffic
When you configure your device to use OpenDNS servers (such as 208.67.222.222 or 208.67.220.220), your DNS queries are routed through their infrastructure. For domains that require filtering, OpenDNS does not return the actual IP address of the target server. Instead, it returns the IP address of its own proxy servers. When your browser connects to this proxy to load bing.com, the proxy initiates a new TLS handshake with your browser.
During this handshake, the OpenDNS proxy generates a certificate on the fly for the domain you requested (bing.com). It signs this certificate using its own Root Certificate Authority (CA). Because your browser expects a certificate signed by Microsoft’s CA (or a globally trusted chain), it detects a mismatch. The browser sees that the issuer is "Cisco OpenDNS" rather than "DigiCert" or "Microsoft," leading to the security alert. This process is technically known as SSL interception or MITM inspection.
Why Browsers Flag This as Unsafe
Modern browsers like Microsoft Edge rely on a strict trust model. They only accept certificates if they can be traced back to a root CA installed in the operating system’s trusted store. OpenDNS does not distribute its root certificate to end-users automatically because doing so would allow anyone to spoof any website securely. Therefore, when you visit a filtered site, Edge correctly identifies that the certificate’s issuer is unknown to your local trust store.
This behavior is intentional. If OpenDNS could issue valid certificates without user consent, malicious actors could replicate this technique to steal passwords or inject ads into secure connections. By forcing users to explicitly trust the OpenDNS root certificate, the service ensures that only those who intentionally configured their network to use OpenDNS will see the intercepted traffic. For all other users, the connection fails securely, protecting them from potential eavesdropping.
Resolving the Security Warning in Microsoft Edge
If you have intentionally set up OpenDNS for parental controls or enterprise security, you need to manually add the OpenDNS root certificate to your Windows Trusted Root Certification Authorities store. This tells Edge that you trust Cisco/OpenDNS to vouch for websites. Follow these steps to resolve the warning:
- Download the Root Certificate: Visit the official OpenDNS support page or search for "OpenDNS Root Certificate." You typically need the file named
OpenDNS_Root_RSA_v1.ceror similar, depending on whether you are using IPv4 or IPv6 resolvers. - Install the Certificate: Double-click the downloaded
.cerfile. In the wizard that appears, select "Install Certificate." - Select Store Location: Choose "Local Machine" if you want to affect all users on the PC, or "Current User" for just your account. Click Next.
- Choose the Store: Select "Place all certificates in the following store" and click Browse. Choose "Trusted Root Certification Authorities." This is critical; do not install it in Personal or Intermediate stores.
- Complete Installation: Click Next and then Finish. You may need administrator privileges to complete this step.
After installation, restart Microsoft Edge. The browser should now recognize the OpenDNS certificate as valid, and the warning for bing.com should disappear. If you do not recognize this setting or did not configure OpenDNS yourself, do not install the certificate, as it may indicate a compromised network or unauthorized software.
Verifying the Trust Chain
You can verify that the certificate is properly installed by navigating to Edge settings, selecting Privacy, search, and services, and clicking Manage certificates. Look for "Cisco Systems" or "OpenDNS" under the Trusted Root Certification Authorities tab. If it is present, the warning should be resolved. For more complex certificate management tasks, such as creating your own CAs for testing environments, you might find resources on creating CA + 2 Certificates with XCA helpful for understanding how certificate chains work internally.
Implications for Internet Security
While convenient for filtering, MITM proxies introduce a single point of failure. If the OpenDNS private key were ever compromised, attackers could decrypt all HTTPS traffic passing through their network. Additionally, some advanced security features like Certificate Transparency logs may not function correctly if the certificate is issued by a non-standard CA. Users concerned about privacy should be aware that OpenDNS can technically see the contents of your encrypted communications, although they claim to only inspect metadata and known bad patterns.
For organizations deploying such solutions, ensuring that the root certificate is distributed via Group Policy or MDM is standard practice to avoid manual intervention on every device. If you encounter issues with certificate exports or management in other contexts, such as DigitCert SMIME Certificate Export Issues, the underlying principles of trust stores remain consistent across different certificate types.
Frequently Asked Questions
Is my data being stolen by OpenDNS?
No, OpenDNS does not steal your data. They act as a proxy to filter content, which requires them to decrypt and re-encrypt traffic. However, this means they technically have the ability to view your unencrypted HTTP traffic and the headers of HTTPS traffic. They generally do not log full content unless it violates their terms of service.
Can I bypass the OpenDNS certificate warning without installing the root CA?
Technically yes, by switching to a different DNS provider like Google DNS (8.8.8.8) or Cloudflare (1.1.1.1), but this disables the filtering features you likely enabled. Within Edge, you cannot simply ignore the warning for a custom CA certificate due to security policies; you must install the root certificate to establish trust.
Why does this happen on bing.com specifically?
Bing.com is often blocked or redirected by parental control filters because it contains image search results that may include inappropriate content. OpenDNS targets high-traffic domains that are commonly used for browsing to ensure effective filtering coverage.
Does this affect other websites besides Bing?
Yes, any website that is categorized as "blocked" or "filtered" by OpenDNS will trigger this warning. Common categories include social media, adult content, or gambling sites, depending on your specific OpenDNS profile settings.
How do I check if my DNS is actually using OpenDNS?
You can check this by running nslookup google.com in your command prompt. If the server listed at the top is not your ISP's DNS but rather 208.67.222.222 or 208.67.220.220, you are using OpenDNS. Alternatively, visit my.opendns.com to see your public IP and resolver information.