Edge - Why is OpenDNS issuing the certificate for bing.com?

Have you ever wondered why OpenDNS is issuing the certificate for bing.com when you use Microsoft Edge? This might seem strange, but there's a simple explanation behind it. In this article, we'll explore why OpenDNS is involved in the certificate issuance process and how it affects your browsing experience.

Before we dive into the details, let's understand what a certificate is and why it's important. In the world of the internet, certificates are used to establish trust and secure communication between your browser and the websites you visit. They ensure that the website you're connecting to is genuine and not an imposter trying to steal your information.

Now, let's talk about OpenDNS. OpenDNS is a popular DNS (Domain Name System) service that provides faster and more reliable access to websites by translating domain names (like bing.com) into IP addresses. It acts as a middleman between your browser and the website you're trying to access.

So, why is OpenDNS involved in the certificate issuance process for bing.com? The reason lies in the way Microsoft Edge (and other browsers) handle DNS requests. When you type a website's address in your browser, it sends a DNS request to find the IP address associated with that domain. By default, Microsoft Edge uses the DNS server provided by your Internet Service Provider (ISP) to resolve these requests.

However, you also have the option to use a different DNS server, such as OpenDNS, for faster and more secure browsing. When you configure your computer or router to use OpenDNS, all your DNS requests are routed through their servers. This means that OpenDNS can see and modify the DNS responses sent back to your browser.

Now, let's connect the dots. When you visit bing.com using Microsoft Edge and OpenDNS as your DNS server, OpenDNS intercepts the DNS request for bing.com and responds with its own IP address. This is known as DNS hijacking or DNS redirection. Instead of receiving the IP address directly from the official DNS server of bing.com, your browser receives the IP address provided by OpenDNS.

But why does OpenDNS do this? The primary reason is to provide additional security features and content filtering. OpenDNS maintains a large database of known malicious websites and blocks access to them. By intercepting DNS requests, OpenDNS can check if the requested website is in their database of malicious sites and prevent you from accessing it.

Now, let's talk about the certificate issuance process. When your browser receives the IP address from OpenDNS, it establishes a secure connection with that IP address. To ensure the security of the connection, the website needs to present a valid certificate issued by a trusted Certificate Authority (CA).

Here's where things get interesting. OpenDNS acts as a proxy between your browser and the website you're trying to access. It intercepts the certificate presented by the website and replaces it with its own certificate. This certificate is issued by OpenDNS itself and is signed by a CA that is trusted by your browser.

This process is known as SSL/TLS interception or SSL/TLS proxying. It allows OpenDNS to inspect the encrypted traffic between your browser and the website, even though the traffic is encrypted using the website's original certificate.

So, when you see OpenDNS issuing the certificate for bing.com in Microsoft Edge, it's because OpenDNS is intercepting the DNS request and replacing the original certificate with its own certificate. This ensures that OpenDNS can inspect and filter the traffic for security purposes.

It's worth noting that this behavior is specific to the configuration where you're using OpenDNS as your DNS server. If you switch back to using your ISP's DNS server, you won't see OpenDNS issuing the certificate for bing.com anymore.

In conclusion, OpenDNS is issuing the certificate for bing.com in Microsoft Edge because it intercepts the DNS request and replaces the original certificate with its own certificate. This allows OpenDNS to provide additional security features and content filtering. If you're concerned about this behavior, you can switch back to using your ISP's DNS server or choose a different DNS service.