Reputation
1,400
Next privilege 2,000 Rep.
Edit questions and answers
Badges
5 16 45
Impact
~152k people reached

Mar
22
awarded  Notable Question
Feb
23
awarded  Famous Question
Jan
27
awarded  Popular Question
Jan
21
awarded  Famous Question
Nov
26
awarded  Nice Question
Nov
1
awarded  Famous Question
Sep
15
awarded  Notable Question
Sep
7
awarded  Popular Question
Aug
21
awarded  Popular Question
Aug
15
awarded  Popular Question
Jul
21
awarded  Notable Question
Jul
7
awarded  Nice Question
May
30
awarded  Yearling
May
5
awarded  Famous Question
Apr
13
accepted Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@MikeScott It happens regularly.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
I agree with your last comment, but I don't agree with your answer.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@k1DBLITZ I know many network people who will know to try by IP address, but won't think twice about getting an SSL error if they only get the error when accessing by IP, because there certs don't tend to have IPs in the AN field. It seems to be a pretty common scenario.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
@MikeScott, your input seem to ignore real world use cases, or how real users behave. Or both.
Apr
13
comment Is the lack of an IP address in the AN field of an SSL certificate a vulnerability?
Thanks for your answer. To clarify my second point, imagine a scenario where an attacker has sabotaged or taken down DNS, so a user has to connect via IP address (a savvy enough user to know how to do so, but not knowledgeable on security). Now when the user connects via IP and the cert isn't valid, isn't it trivial to MitM at this stage?