That’s not the expected certificate for a *.eu.auth0.com
account. It seems something in that specific machine is forcing a request to [your_account].eu.auth0.com
to be redirected/intercepted and then responded from an endpoint that is presenting a certificate that does not match. In general, this situation is highly suspicious so if you did not do any explicit steps to have some type of interception mechanism that would explain this behavior then I would consider that part of some malicious activity.
Do you only get the certificate issue when accessing https://[your_account].eu.auth0.com
or do you get similar issues when accessing other HTTPS sites? For example, what happens if you access https://jwt.io
? Can you also share the output of the following command: nslookup [your_account].eu.auth0.com
?
UPDATE:
The IP address mentioned in the output of the curl command is no longer associated with accounts at *.eu.auth0.com
. However, a quick online check shows that the IP in question is associated with the same cloud infrastructure provider used by Auth0 so the IP may at some point be associated with Auth0. However, these IP’s can change so ensure that you have nothing in your machine that hardcoded the IP address used at a certain point in time. You can see the IP addresses that are currently associated with your Auth0 account in the output of the nslookup command.