The vk.com certificate is forged, how to catch (Provider, proxy, hack programs) who is doing this?

Question

Computer networks

Scheme Comp -> My Gateway WinServer nat -> provider N
I go to the page https:\\vk.com
and issue a proxy certificate. N .ru (Which is not valid
if you get it like that and you will get a normal one..
************** faked
To whom the proxy is issued. N .ru
(publisher)
E = [email protected] N . ru
CN = proxy N .ru
OU = IT
O = X (company code)
L = X (city here)
S = Moscow Region
C = RU
************* normal and so on) the
browser swears sometimes .
_
(VK also has an additional subject name)
DNS-name=*.vk.com
DNS-name=vk.com
**************
I looked at Cain&Abel, there seems to be no such thing.
Intercepter-NG has SSL strip I don't remember something like that? but I didn’t find where you can set the certificate parameters ...
Squid https - in theory this is the most optimal .. The
question is what distinguishes or in more detail about Squid SSL and Squid transparent
HTTPS
me open or encrypted over HTTPS to the site (that is, the proxy does not see)?

Answer 1

Look at the data of the root certificate of this fake one.
Search trusted publishers for this root certificate and find out how it got there.