0

Let's say I am behind my PC and want to go to any secured website (HTTPS). I have the direct IP address so any possible hack on DNS level is not possible (because I am not using it ;) ).

The packet which is going to the right place (to the secured website) goes through different ISP servers.

Some malicious hacker is sitting on one of those servers between me and the website. He responds with a wrong certificate and tries to make a secure connection with me sitting behind my PC. He is faking that he is the website.

When someone purchased a certificate from VeriSign for example they always asks for a domain name.

From that point I am the only one with a certificate for that domain. A hacker can't purchase a certificate with the same domain name (correct me if this is wrong!!).

So my question is: Is a web browser (Firefox, IE, Chrome, Opera, Safari etc.) capable of detecting that the certificate is not for the corresponding domain, and give an error back that something strange happened along the way?

If you have any more information on this topic, please tell me.

8
  • "From that point I am the only one with a certificate from that domain." Why?
    – user49075
    Commented Jan 12, 2015 at 10:11
  • When I purchase an certificate the company who will give me one will check if I am the owner of the domain. If I can prove if this is true then they will give me an certificate. Of course I can purchase more certificates for one domain. But the malicious hacker is not able in getting an certificate with my domain name in it, because he/she can not prove that the domain is his/her domain.
    – user56656
    Commented Jan 12, 2015 at 10:15
  • That will only last until the certificate gets used. Of course, it should still be the case that the only certificate(s) for that site is(/are) for your public key(s).
    – user49075
    Commented Jan 12, 2015 at 10:17
  • 1
    Sorry, I am not following you right now. Can give some more info?
    – user56656
    Commented Jan 12, 2015 at 10:24
  • Certificates are usually sent in clear, so it would usually be easy for someone else to get a copy of your certificate.
    – user49075
    Commented Jan 12, 2015 at 10:32

1 Answer 1

2

To the best of my knowledge the problem you'll encounter in the described scenario is that certificates don't usually work by IP address

This may vary from site to site, so test against your desired site by browsing to it via IP and seeing if you get a valid HTTPS connection.

The rest of the question is more straightforward - yes browsers will give you a certificate error if there's an issue with the cert. Unfortunately most users just click through these errors because they don't care or know enough to understand the risk.

You are correct in thinking that it's not possible to buy a certificate for a domain someone already has the certificate for - or not from a trusted CA (Certificate Authority) anyway. What an attacker will usually do is self-sign a certificate, so if you inspect it, it will show as being for the correct site, but browsers should throw a warning at you because the CA is untrusted.

6
  • Thanks this is really helping. Would it be possible for an hacker to download my certificate from my site and use it?
    – user56656
    Commented Jan 12, 2015 at 10:25
  • May be worth reading here: security.stackexchange.com/questions/20803/… But in short, no, they would need your private key from your server (which would require compromising the machine).
    – AlexH
    Commented Jan 12, 2015 at 10:26
  • Thanks. So if I try google (google.com) will work but when I try the ip address (173.194.79.99) it is giving me an certificate error of untrusted.... But it is possible to purchase an certificate based on ip address, right?
    – user56656
    Commented Jan 12, 2015 at 10:34
  • Yeah, the browser tries to match the certificate against what's in the URL bar, and since the certificate is for google.com it comes back as invalid. Some places will have SSL certificates on their IP addresses, but I suspect it would be a nightmare for Google to manage that with the number IPs they have!
    – AlexH
    Commented Jan 12, 2015 at 10:37
  • That would be an nightmare indeed! But just to be sure it is possible to purchase an Certificate for an ip address right?
    – user56656
    Commented Jan 12, 2015 at 10:38

You must log in to answer this question.