I was talking with a friend about how SSL can be Man-in-the-Middled with relative ease. He claimed this:
- Anyone can compromise the DNS request authority chain (true).
- Anyone can generate a custom priv/pub key (true).
- Anyone can request (purchase) a certificate on behalf on any domain name (true?)
With this in mind, I could:
- Compromise a network (country-wide, say - Assume I am a government)
- intercept DNS requests with a custom DNS (country-wide, again) server
- issue a certificate for any domain (e.g. a wildcard for *.google.com, and spend more money for wildcards in every ccTLD in that domain)
- accept HTTPS requests, which resolve (via my compromised DNS) to my custom proxy with the intention of proxy-pass the http requests to the TRUE google server, but having a valid certificate (since it was actually issues legally, it has its valid chain), so no web browser would complain regarding an invalid certificate.
I had no words to reply back, and started to doubt, just by thinking that certificate authorities check you are the owner of the domain you want to issue a certificate to.
Is there any way to MitM like my friend said? Or what am I missing?