Symantec SSL Trial Certificate issues certificates without validation that the domain is owned by the one requesting the certificate. Doesn't this make it easy to do a man in the middle attack against any websites?

For more information see [Symantec Trial Certificate Website][1] enter image description here enter image description here

  • 1
    I've edited the question because it was hardly possible to understand what you were asking. Please check if the edit reflects what you've tried to ask. – Steffen Ullrich Oct 20 '16 at 16:55

The SSL certificate issued using this process is not trusted by default by any software and thus cannot do any harm as long as the software is doing proper validation of certificates. And if the software is not doing proper validation there is no hope for this software anyway, i.e. you don't need this trial certificate but can create your own.

From the documentation:

In order to test the use of a Symantec SSL Trial certificate, you must install a special Symantec Trial Intermediate and Symantec Trial Root CA on the server. The Trial Root must also be installed in each browser that will be used during the testing phase. This is a special step that Symantec has implemented to prevent fraudulent use of trial certificates. When purchasing a production SSL certificate, these additional steps are not necessary.

  • I just make my trial and it's work they trust my certificate in browser with Apache 2 server – sami Oct 20 '16 at 17:00
  • @sami: I have no idea how you tested but it should only work if you've explicitly included the Trial Root CA into your browser. Otherwise the validation should fail, i.e browser should show an appropriate warning. – Steffen Ullrich Oct 20 '16 at 17:05
  • i never import Trial Root CA into my browser and it's work!! they trust certificate with any website except wildcard and facebook and google when import csr to Symantec – sami Oct 20 '16 at 17:09
  • @sami: If the site is public please offer the link so I can check myself. If not please provide the certificate or at least a screenshot of the trust chain as seen in the browser so one can have some way to verify what you say. – Steffen Ullrich Oct 20 '16 at 17:13
  • just one moment – sami Oct 20 '16 at 17:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.