When submitting a SSL certificate signing request (to a CA) for the public key of
is it possible to add some target domain, e.g.
to the "Subject Alternative Name" of the CSR?
If this is possible, and I was able to control a network node between visitors of
security.stackexchange.com and their browsers, and send my own responses, then does that mean the browser would simply accept my fraudulent communications?
I understand certificate pinning could solve this, but other than certificate pinning, is this attack possible?