This is my understanding of Digital Certificate Signing mechanism so far. Correct me if I am wrong.
- www.abc.com(SSL enabled) is typed in the browser for the first time
- The server of abc.com sends it's public key and a Digital Signature to the browser. Along with other content, the Digital Signature contains abc.com's public key in an encrypted form. That encryption is performed with Digital Signature's private key
- The Digital Signature is decrypted with the corresponding public key already stored in the Browser(already stored because it is from a Certified Authority). This decryption gives Server's public key
- The decrypted public key and plainly sent public key are compared for equality to verify the Trust
- If successful, then the symmetric key is generated, encrypted with the server's public key and sent for further communication.
Now, consider a possibility for MITM attack:
- The hacker gets a copy of data packets that are transmitted from server to browser after step 2
- Since every browser has CA's public key, he can decrypt the digital signature and verify the equality with server's public keys
- Now, he can further generate his own version of the symmetric key, encrypt with server's public key, send to the server and pretend like an actual user
So, can a hacker's symmetric key possibly confuse the server with the original symmetric key sent by the actual user?
Will the server reply back to a hacker or only to the actual user?
Is this vulnerable or is that not possible?
Do correct me what I am missing.