Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

Say my domain (https://example.com) SSL private key has been stolen and was not protected by a passphrase then.

  1. Can the attacker uses that key and certificate to host the same domain on different server, if he can some how convince DNS server to point to new server ip address.
  2. Will there be any alert at users end

I just want to know if the above case is possible,I am aware about how he can use that to decrypt traffic.

share|improve this question

4 Answers 4

up vote 6 down vote accepted

Yes, if someone steals your private key, then he can make a fake server with the same name, and users won't see anything wrong with it (provided the attacker redirects connections to his server, e.g. by altering the DNS).

No, users will not be warned.

From the point of view of both the CA and the user browser, a fake server with a stolen key is not different from a Web server being moved to another IP address, e.g. as part of a DNS-based load balancing. When you have a server and a certificate, the certificate is in no way locked to whatever IP address you presently used; browsers only check that the server name appears in the certificate (see RFC 2818, section 3.1). You are free to copy your private key and certificates to another server with another IP address, and make the DNS point to that new address. The only difference with the attack scenario you describe (key theft) is that this time you really want it. Whether you agree to the IP move or not cannot be checked by the client, and, correspondingly, the client does not check it in any way.

So protect your private key, and, if it gets stolen, report the theft to your CA which will then revoke the certificate.

share|improve this answer

It depends on your SSL certificate. Most SSL certificates are only 'locked' to a specific domain ('domain validated SSL Certificate'), so if an attacker could do what you describe, convincing DNS servers to point to a new IP address, then yes the attacker could use it to spoof your website as a phishing location. Some advanced 'single IP-address SSL certificates' can also be locked to a specific IP, though. In that case the scenario you mention couldn't happen and the user would be notified there's a problem with the SSL certificate used.

share|improve this answer
5  
I have yet to see a certificate in the wild with an IP address in it, and, more to the point, a browser which checks that IP address. –  Thomas Pornin Jan 31 '13 at 12:17
    
You often need an IP address per domain not because any specific address is embedded in the certificate but because the SSL handshake takes place before the browser gets a chance to send the HTTP Host header. The server has to know which certificate to send and it's easiest if every domain uses a separate IP. You can also use different port per domain, but then your address will be https://example.com:12345/ instead https://example.com/ for every port other than 443. There is now Server Name Indication to solve that issue but it doesn't work on Windows XP which stops its adoption. –  Zed Jan 31 '13 at 12:36
    
@Thomas Pornin - To my knowledge the common name header in the SSL certificate (the one it's verified against with CA) can contain an IP address. Or a wildcard, for example for sub-domains *.example.com. I'm not sure what number of web browsers support such certificates, but according to the link I now added to my post, they quote 99.99% browser support. –  TildalWave Feb 1 '13 at 1:34
    
@TildalWave: it is true that the Subject Alt Name extension can contain IP addresses; but it is equally true that no client checks them. Clients follow RFC 2818 and check names of type dNSName, i.e. server names. As for wildcards, they are supported but they are still about names, not IP addresses; and they are quite the opposite of "locking". –  Thomas Pornin Feb 1 '13 at 11:59
    
@Thomas Pornin - But couldn't technically speaking that header simply contain an IP address? Saying it otherwise, if the DNS look-up doesn't resolve, wouldn't it default to the IP then? I'm not saying this is how it works, don't get me wrong, I'm just assuming based on my own understanding of things and it's also what value I return for non-resolvable DNS look-ups with my own socks libraries (default behavior, which can be changed of course). How can that business I link to in my post then offer 'SSL Certificates that are specially issued to secure an IP-address'? Thanks & cheers! –  TildalWave Feb 1 '13 at 15:32
  1. Yes
  2. No

If you can use that key and certificate to host that domain on your server then also the attacker can use that key and certificate to host the same domain on a different server.

That is if he can convince the DNS server to point to the new server IP address or he can just poison some DNS server on some network (which is easier than most people think) and target only users of that network, or spoof DNS responses on some some LAN and target users that are nearby (also easy).

Your users will not only not be warned. They will in fact get the information that the connection is secure - the padlock, green address bar, company name and all that.

share|improve this answer

As an extra information to the other answers:

Assuming you know that an attacker has stolen your key and you have contacted your CA and asked them to revoke the certificate, then browser alerts may be triggered.

Modern browsers check if a certificate is valid by using OCSP (Online Certification Status Protocol) and the users are warned when they access sites with revoked certificates.

share|improve this answer
1  
That being said, some browsers treat inability to verify revocation status as a "soft fail" and will trust the certificate. So, if the attacker that has your site's private key is able to fully MITM your traffic (e.g. via a rogue AP), they can refuse access to the OCSP server and pass the revoked certificate as still valid. Chrome has repeatedly threatened to not even bother with OCSP, famously calling it "seat belts that snap when you crash" (arstechnica.com/business/2012/02/…). –  mricon Jan 31 '13 at 15:34
    
It is true, but the problem was that the server certificate is compromised and not every user's network. I checked today and Chrome is performing Ocsp checks. –  Dinu S Jan 31 '13 at 19:43

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.