Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

How its possible to detect authenticity Of Client and Server Certificate.

For example, If server A has certificate and someone C stolen its certificate and send it to B then How we decide that it's send by A or some one else ?

Same question for client certificate authenticity.

I know that the private key is belongs to only the correct owner, but still is there any way to identify the sender of certificate ?

share|improve this question
up vote 0 down vote accepted

You need to trust someone. Certificates that are presented to you are checked by your verification software:

  1. Is the certificate's upstream root certificate in your trust store? (I.e. do you trust someone who is telling you that they trust A's certificate?)
  2. The verification software also checks either the Certificate Revocation List (CRL) or uses the Online Certificate Status Protocol (OCSP) to see if the certificate was revoked before its expiration date.
  3. Verification also includes other checks that are beyond the scope of your question.

To answer your question a different way (using your example scenario):

  1. It should be very hard to steal the private key for server's A certificate. For digital signatures, (my company's focus), the private keys are usually stored in a dedicated hardware appliance that includes anti-tamper switches. If someone opens the box, everything is erased.
  2. If someone does indeed manage to steal A's private key, then yes, they can masquerade as A until either someone discovers the theft and has the CRL/OCSP system updated or until A's certificate expires.

It is for exactly the reasons that you ask about that digital signature certificates for people should be tightly controlled. A Secure Signature Creation Device should be used.

[Disclosure: I work for CoSign]

share|improve this answer
So you mean there is no way that we can identify the user who sent us, just we need to make complete ssl handshake or need to identify via public/private key. – Johan Gelp Dec 2 '13 at 7:15
I don't understand your comment, can you re-phrase it? There are many ways to identify users. SSL protects the data channel by encrypting the conversation. It also enables the server's certificate to be easily examined by the user/client. – Larry K Dec 2 '13 at 10:47
My Question is,if someone stolen your certificate and send to another user, how end user identify the sender is actual or fraud ? – Johan Gelp Dec 2 '13 at 12:03
If B steals A's private key, then C cannot tell the difference between A and B via just the certificate. But C might be able to tell the difference between A & B by using additional information, eg IP address, behavior, etc. But the most important issue is that if A wants to protect his identity then he should guard his private key very carefully! – Larry K Dec 2 '13 at 18:51

There are two ways to detect if the sender is the legitimate owner of the certificate (which we assume is the only person who has the correct private keys).

  1. Encrypt something with the public key and get the owner to return you the plaintext. If he can correctly decrypt the ciphertext, that means he has the private key.

  2. Get the owner to sign some plaintext provided by you. Then "decrypt" the digital signature with his public keys, if it matches your plaintext then we can be sure that he has the private key too.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.