When connecting to a new AP, the client device will pop a warning to ask if the certificate of the new AP should be trusted. If trusted, the warning doesn't show anymore if the certificate is known to have been trusted before. What attributes of the certificate does the client use to determine if two certificates are the same? (E.g is it the CN or a hash of all the attributes of the certificate)

If the attributes used for comparison are trivial to spoof, does this mean that an attacker can easily set up a Rogue AP with the same exact certificate as the legitimate one and there will be no way to tell?


You must log in to answer this question.