1

Assuming that I have a certificate for my local webserver signed by a well known CA like Verisign (so it will be trusted by browsers), and I'm able to DNS poisoning in Man-in-the-Middle to redirect a user who wants to go to google.com on my local webserver who has the same hostname google.com, what will be the consequences?

Is there a risk? If so, how to prevent it?

I don't know why SSL pinning is only used for mobile app. If the attack above works, so SSL pinning can be a prevention. But it's not used on computer...

Improve this question

1 Answer 1

Reset to default
5

In order for that to succeed the server's hostname would have to match the certificate name. That means you would have to either get a CA to issue a cert as google.com (not likely to happen) or you would have to get a root cert from a CA you control and install that on the user's computer as a trusted CA certificate.

Even then, many big web sites use public key pinning which forces the browser to only accept a specific cert until a pre-stated expiration date. Both Chromium and Firefox do support pinning.

Improve this answer
4
  • I think pinning is for keys, not certs. Are you talking about something other than HPKP? I think that is all that's supported in common browsers
    – Neil Smithline
    Commented Jun 4, 2016 at 3:40
  • @NeilSmithline: Yes, pinning is for the public keys of the certificate. But since the matching private key is only known to the owner of the certificate this means essentially a specific cert, only that it tolerates renewing (but not rekeying) of the certificate.
    – Steffen Ullrich
    Commented Jun 4, 2016 at 4:52
  • Nothing prevents me to create my local webserver with the hostname "www.google.com", generate a CSR, and get signed by Verisign. Or, Verisign will refuse to sign it because of it ? Also, each time I'm looking for informations on SSL pinning, it related to app mobile. Are you sure It is also used with computers?
    – Duke Nukem
    Commented Jun 4, 2016 at 9:27
  • @DukeNukem Verisign will require proof that you own google.com. Since you don't, they won't give you the cert. You can search for 'domain verification certificate' to learn more about the process
    – Neil Smithline
    Commented Jun 4, 2016 at 13:18

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .