To my understanding, the client verifies the server certificate by checking whether the issuer DN (Distinguished Name) is equal to the subject DN in the root certificate ? If this is the case, anyone can put a Microsoft's DN in his certificate's issuer DN and send it to the client along with a Microsoft's certificate that is being trusted by every computer. How does this certificate validate and verifies the server then ?

  • You are mistaken. The client checks the signature of the certificate to determine if it is legitimate. – Luke Park May 16 '16 at 13:00

Short answer:

No, not everyone can send a modified certificate to the client. Every certificate is digitally signed and the clients check these signatures.

So you either need to ...

  • create a fake signature (which is cryptographically hard),
  • get a certificate autority to sign your certificate (which they should refuse to, because you are not owner of microsoft.com)
  • or sign the certificate with a self-made root certificate (then you can sign anything - but no PC will trust you as long as your root certificate is not imported into their system).
  • the certificate's signature is actually, a hash of the certificate encrypted by CA's private key ? – Mamoon Ahmed May 19 '16 at 3:40
  • so calculate the hash of the server certificate, then, In server certificate I decrypt the signature Value with CA's public key, and compare both hashes. Am i right now ? – Mamoon Ahmed May 19 '16 at 3:42
  • @MamoonAhmed I think you got it right. – Lukas May 19 '16 at 7:48
  • oh . . . you dont know how much those words gave me pleasure ..... should i delete the question or leave it ? – Mamoon Ahmed May 19 '16 at 22:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.