In a MITM-Attack I can exchange the server certificate by one I created on my own with tools like MITMProxy or SSLSplit. But this only works well when I have installed a fake CA cerrtificate in the victims browser otherwise it's identified as a fake certificate.

Would it be possible to create fake certicates that seems to be issued by the original CA and then fake the OCSP Response so the certificate seems valid?


OCSP is a way for the CA to INVALIDATE specific certificates. A browser will also check the signature of the supplied certificate against the CA's root certificate (possibly in a few steps, the certification chain), this is done completely locally.

So in short, no it is not possible to make a fake certificate look valid without replacing the CA's root certificate in the users browser. (Only a certificate in the chain should not be enough.)


AFAIK, it shouldn't be possible to create a certificate that "seems to be issued by the original CA" in such a way that even an OCSP request occurs. At the point where the check happens (if at happens at all, after all it's e.g. considered practically broken on the web because on servers being unreliable in handling the requests) the certificate should already have a valid certificate chain, one with a CA in your keystore (BTW, not necessarily managed by your browser) on top.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.