1

Assuming that I have a certificate for my local webserver signed by a well known CA like Verisign (so it will be trusted by browsers), and I'm able to DNS poisoning in Man-in-the-Middle to redirect a user who wants to go to google.com on my local webserver who has the same hostname google.com, what will be the consequences?

Is there a risk? If so, how to prevent it?

I don't know why SSL pinning is only used for mobile app. If the attack above works, so SSL pinning can be a prevention. But it's not used on computer...

4

In order for that to succeed the server's hostname would have to match the certificate name. That means you would have to either get a CA to issue a cert as google.com (not likely to happen) or you would have to get a root cert from a CA you control and install that on the user's computer as a trusted CA certificate.

Even then, many big web sites use public key pinning which forces the browser to only accept a specific cert until a pre-stated expiration date. Both Chromium and Firefox do support pinning.

  • I think pinning is for keys, not certs. Are you talking about something other than HPKP? I think that is all that's supported in common browsers – Neil Smithline Jun 4 '16 at 3:40
  • @NeilSmithline: Yes, pinning is for the public keys of the certificate. But since the matching private key is only known to the owner of the certificate this means essentially a specific cert, only that it tolerates renewing (but not rekeying) of the certificate. – Steffen Ullrich Jun 4 '16 at 4:52
  • Nothing prevents me to create my local webserver with the hostname "www.google.com", generate a CSR, and get signed by Verisign. Or, Verisign will refuse to sign it because of it ? Also, each time I'm looking for informations on SSL pinning, it related to app mobile. Are you sure It is also used with computers? – Duke Nukem Jun 4 '16 at 9:27
  • @DukeNukem Verisign will require proof that you own google.com. Since you don't, they won't give you the cert. You can search for 'domain verification certificate' to learn more about the process – Neil Smithline Jun 4 '16 at 13:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.