I know about SSL certificates. However it is ok to say:
protocol HTTPS protects against connecting to false server ?


protocol HTTPS protects against connecting to false server ?

It depends on what you consider a false server but given this weak phrase I would suggest the answer should be NO. Lets's see what you get with https and what you get not:

  • You get that the browser checks if the hostname of the URL matches the certificates subject and if this certificate is otherwise valid. That means it also checks the trust chain, expiration and purpose. This means you can be usually sure that some certificate agency trusted by your browser has issued this certificate. How much this says about false or not see below.
  • It should check the revocation status too but this is were most browsers already fail: either they don't care about temporary errors when checking the revocation (see Revocation doesn't work) or they only consider some certificates as important for revocation and other not (Chrome CRLSets). Thus a revoked certificate can often be used for a man in the middle attack. You are probably safe in case of Extended Validation (EV) certificates - the ones with the green bar.
  • There are lots of trusted certificate issuers in the browser and each of these can issue certificates for all sites. In the past it happened several times that certificate agencies got hacked and issued certificates for high-profile sites which were accepted by the browsers and could used for man in the middle attacks. And these were actually used in real attacks. There are some workarounds this problem like certificate pinning but it needs to be explicitly used. Again, sites with EV certificates are probably more safe here since only a few CA can issue such certificates, but there is no 100% safety too. And of course this means that you expect an EV certificate in the first place.
  • Even if the original certificate is fine there might be a SSL interception or man in the middle attack. Both are essentially the same but the first one is considered legal and the second one not. With SSL interception one usually trusts the interceptor and for that has added another trusted CA to the system or browser. Such SSL interception is used within deep inspection firewalls and several Antivirus products to scan for malware inside HTTPS connections. If you use this you no longer depend on the correctness of the browser to validate the certificate but on the SSL interception product. And these often fail to do proper validation or even reuse the same known CA for all systems and thus allow an attacker to reuse this trusted CA for man in the middle attacks (see SuperFish).
  • And even if everything is fine until now it can still happen that you connect to a false site if you entered the wrong site name (typo) or if you followed a link and the site looks legit (i.e. super-secure.paypal.example.com). HTTPS does not protect you against visiting the wrong site.
  • And of course you could visit the correct site but the site has been hacked and will steal lots of important information from you. A valid certificate does nothing say about the security of the site!
  • Or this is just a good looking but shady business etc. Everybody can get a domain and a certificate for it. A valid certificate does nothing say about how much you could trust a site!
  • And then we have from time to time critical errors in the TLS stack. These attacks could cause the client to accept invalid certificates like with goto fail. Or the private key of the server could be compromised like in Heartbleed and the attacker might use this then for a man in the middle attack.
  • Apart from that we have attacks against the TLS protocol, like weak diffie hellman keys and others. Some of these attacks might be used to incorporate a server or do a man in the middle attack. While important I personally consider these kind of weaknesses harder to exploit then the ones I'me mentioned so far.

Even with all these problems HTTPS still provides way more security the plain HTTP. But you should be aware of the problems and not believe that everything is fine just because it says HTTPS.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.