1

A digital certificate is supposed to be used between client and server in order to establish the initial trust. The client has to choose to trust the server.

I can understand in a secure model, the client will always know who the server is. https://internal.sitea returns a certificate that the client would recognize since it has had dozens of previous exchanges.

But what is to prevent someone in the middle doing a simple hello with the server, and reusing the digital certificate, to establish its own cipher suite with the client, and acting fully as a man in the middle?

I apologize if I am misunderstanding anything about the overall certificate exchange process. Please feel free to let me know.

4

Certificates establish that a public key belongs to a certain entity. So if I verify and accept a certificate, I will use the public key in that certificate to encrypt my TLS handshake data. A man in the middle will need the corresponding private key to decrypt that data and complete the handshake. Therefore, the certificate alone is not sufficient. The corresponding private key is required to make use of the certificate.

  • It may be worth expanding to mention the Subject Name / Subject Alternate Name portion of the certificate specifically, since that's the part that prevents a trusted certificate/private-public key pair for a different subject from being used, but great answer. – crovers Nov 30 '16 at 22:09
  • @k62 I am guessing then that the client will reject the certificate if it had a different public key than originally expected? – christopher clark Nov 30 '16 at 22:13
  • Yes. The certificate data is signed with the certificate authority's private key and a signing algorithm. If you alter the certificate, verification of the certificate against the signature will fail. To resign the certificate, the attacker would need the certificate authority's private key. – user68527 Nov 30 '16 at 22:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.