I have done a small test and result is as expected, but I am trying to understand more. I have configured a fake DNS server to resolve all names to the IP of my VPS. On my VPS, I installed a web server with SSL, then set my client computer DNS to fake DNS.
when I ping from CMD tool to Facebook.com the server resolves the IP to VPS web server IP (this is good). When I am trying open Facebook from chrome browser it says connection is insecure, but if direct try open IP of VPS with HTTPS it is successful.
I want to understand how Chrome check connection is insecure before handshake with real Facebook? If VPS also includes a real SSL certificate why does chrome not open successfully? According to my understanding Chrome gets the IP of domain (Facebook) from fake DNS, and tries to open IP of Facebook. (VPS IP in this case) If remote VPS also includes SSL that opens successfully if I try direct IP of VPS, why don't other web sites forward to VPS with SSL connection?
My browser's message is:
www.facebook.com normally uses encryption to protect your information. When Google Chrome tried to connect to www.facebook.com this time, the website sent back unusual and incorrect credentials. This may happen when an attacker is trying to pretend to be www.facebook.com, or a Wi-Fi sign-in screen has interrupted the connection. Your information is still secure because Google Chrome stopped the connection before any data was exchanged.