Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the victims browser otherwise it's identified as a fake certificate.
Would it be possible to create fake certicates that seems to be issued by the original CA and then fake the OCSP Response so the certificate seems valid?
OCSP is a way for the CA to INVALIDATE specific certificates. A browser will also check the signature of the supplied certificate against the CA's root certificate (possibly in a few steps, the certification chain), this is done completely locally.
So in short, no it is not possible to make a fake certificate look valid without replacing the CA's root certificate in the users browser. (Only a certificate in the chain should not be enough.)
AFAIK, it shouldn't be possible to create a certificate that "seems to be issued by the original CA" in such a way that even an OCSP request occurs. At the point where the check happens (if at happens at all, after all it's e.g. considered practically broken on the web because on servers being unreliable in handling the requests) the certificate should already have a valid certificate chain, one with a CA in your keystore (BTW, not necessarily managed by your browser) on top.
