While doing some research with SSL certificates, I found some weird certificates containing nul bytes in their Subject field. One example is
www.refah - bank.ir (did the Iranian government fake this CA? It looks very similar to a Spanish CA except for location...).
Another example is
mcafee.com which looks more trustworthy to me. They have two different IP addresses for
www.mcafee.com, the certificate also differs. What surprised me was that such a company uses certificates containing nul bytes in their Subject field:
Data: Version: 3 (0x2) Serial Number: c8:e6:3c:67:a8:7f:38:ba:c9:ab:06:ef:4e:68:67:0d Signature Algorithm: sha1WithRSAEncryption Issuer: O=Network Associates, OU=NAI Certificate Services, CN=NAI SSL CA v1 Validity Not Before: Aug 26 20:36:38 2008 GMT Not After : Apr 26 09:28:50 2019 GMT Subject: C=US, ST=Texas, L=Plano, O=McAfee, Inc, OU=IIS-Plano, CN=\x00*\x00.\x00m\x00c\x00a\x00f\x00e\x00e\x00.\x00c\x00o\x00m
mcafee.com correctly rejected the certificate as the wildcard does not match against this. Out of curiosity, I edited my host file and made
www.) point to the IP address 220.127.116.11 (mcafee.com).
I would expect such a certificate to be rejected, but Firefox and Chromium both accept this certificate.
I found another website that has nul bytes in the CN and is still "trusted": https://www.digiturk.com.tr
What is happening here?