Let's say I have a client, not a browser, that wants to connect with https to a server. It could be a python program, an android app or a library etc. Suppose the client has a list of trusted CAs and their public keys.
What checks the client should make to verify that the certificate is valid and avoid man in the middle attacks and what attacks is possible if the client doesn't make this checks?
I know a lot of libraries do this for you but a lot of things can go wrong. The question is mostly theoretical.
As far I have understood you should check:
- If the issuer (CA) of the certificate is in your trusted list and the public key of the issuer is the correct one.
- Check CN to match the domain/IP you are connecting
- If the certificate is expired
- Something about X509v3 extension and basic constrains that I haven't understood correctly.