2

I've been doing some research into SSL for a paper for school, so please forgive my ignorance and lack of experience in this subject. While doing my research I have noticed that some websites when you do a nslookup on them and then search the IP address in chrome it varies what happens. When you nslookup google I get 172.217.7.174 and when you enter that it redirects to google.com as expected. But when you do the same for yahoo.com it takes you to an empty page. When you do it for Microsoft.com 23.100.122.175 it takes you to a "your connection is not private" page and then from there, you can see the information for Microsofts wildcard cert when you click NET::ERR_CERT_COMMON_NAME_INVALID.

So my questions are:

Isn't the private key for a cert supposed to be kept a secret? Is it okay to have your website like microsoft's that displays the cert in its entirety? If someone gets your cert cant they spoof your websites? Shouldn't you be implementing some sort of redirect for IP addresses like a 301 or something?

Improve this question
  • Certificates are public information. Your browser receives a copy every time it makes a connection to an HTTPS site. Private keys are private, obviously, but I kinda doubt the certificate you saw included the private key. – Ajedi32 Sep 27 '18 at 16:07
  • Since you mentioned about preparing the paper, you should study the basic : en.wikipedia.org/wiki/Public_key_infrastructure – mootmoot Sep 27 '18 at 16:27
  • As for the question of the website hijack, please go research "DNS spoofing" , "Men in the middle attack", "phishing" – mootmoot Sep 27 '18 at 16:31
2

The certificate does not show only when you access by IP. On Firefox, if you click on the padlock icon and show more information, you can get the certificate of the site you are accessing. It's public information, so no need to protect it.

Is it okay to have your website like Microsoft's that displays the cert in its entirety?

The certificate does not contain the private key, only the public key. Otherwise there would be no security at all in implementing a certificate.

If someone gets your certificate can't they spoof your websites?

No, the attacker needs the private key of the certificate too. The certificate only contains the public key, the private key is stored on the server, usually on a very special appliance (the Hardware Security Module - HSM).

Shouldn't you be implementing some sort of redirect for IP addresses like a 301 or something?

Very, very few people will ever try to access Google or Yahoo or whatever using the IP, and usually certificates are not issued for IP addresses. So it's an exception so rare that does not really need to be addressed.

Improve this answer
  • I don't know I'd say that private keys are usually stored on HSMs. I think in the vast majority of cases they're stored on the server's hard drive as just another file, because most personal projects and even companies don't have access to HSMs or really need that level of security. – Xiong Chiamiov Dec 26 '18 at 19:08
2

Isn't the private key for a cert supposed to be kept a secret? Is it okay to have your website like microsoft's that displays the cert in its entirety? If someone gets your cert cant they spoof your websites? Shouldn't you be implementing some sort of redirect for IP addresses like a 301 or something?

The private key is kept private - and should be kept private. But you're not seeing the private key. You're seeing the public key and certificate, which authenticates that the corresponding private key is controlled by Microsoft.

If you want to see the certificate of any TLS-secured web site, press F12 (in Chrome and FF at least), and check the security tab of the console. It will show you the complete certificate - but not the private key.

The reason you get a warning when you enter an IP is that the browser compares the name in the certificate (e.g. www.microsoft.com) to what is stated in the certificate Common Name (CN) and Alternate Name. If they match, and the certificate is signed by a trusted entity, no warning is shown. But when you access by IP, the name does not match what you've entered - and an warning is shown.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.