0

Supposing an attacker is able to perform a Man In The Middle attack and intercept requests from a client that wants to connect to an HTTPS server (let's say www.google.com).

The attacker has a valid certificate (domain : www.randomname.com) signed by Verizon.

He will then redirect the client to his fake server.

Normally, there will be no warning as the certificate is signed by a trusted CA.

Is this a way to bypass HTST protection?

Improve this question
1

1 Answer 1

Reset to default
2

Normally, there will be no warning as the certificate is signed by a trusted CA.

Wrong. Since the subject of the certificate ( www.randomname.com) does not match the URL (www.google.com) the validation will fail and the browser complain. It does not matter if this is "only" a redirect, i.e. even for the domain you redirect from you need a proper certificate.

Improve this answer
2
  • The domain name check mecanism is provided by HSTS right?
    – Duke Nukem
    Commented Jul 25, 2016 at 18:38
  • 1
    @DukeNukem: No, the check of the subject against the name in the URL is part of the normal certificate validation and is done even without HSTS or similar. Without this check man in the middle attacks would be trivial.
    – Steffen Ullrich
    Commented Jul 25, 2016 at 18:49

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .