I'm trying to solve an online challenge and I've hit a wall. We're given the address of a web server with two endpoints:
One endpoint accepts a CSR and a private key and returns a certificate signed by the server's SSL certificate if, and only if, the CN specified in the CSR is not "administrator". The server's certificate is self signed.
The other endpoint implements TLS 1.2 and asks for a client certificate that has the 'Distinguished Name` set to the server's organization name (I've picked that up from Wireshark).
After the connection is established, the server returns either a regular page for non-administrators, or a special page (which contains information I'm supposed to steal) for the administrator.
The only idea I've had so far was to generate two certificates:
- One will be used as the CA and will have the DN set to the server's organization name
- The other will have the CN set to "administrator" and will be signed by the first certificate. While the browser did offer to use that certificate while handshaking, a general TLS connection error followed immediately after.
Are there any known attack vectors against this setup that I should get myself familiar with?