Say, the goal is to facilitate secure communication between two parties. The definition of secure is that
- both parties can be sure that they are actually talking to a trusted party, not somebody else
- they can be sure that no third party is listening to the communication
Furthermore, I have a Certificate Authority (CA), and the two parties (rightly) trust all certificates coming from that CA. Only trusted parties have a certificate. They do not trust any other certificates. The possession of a valid certificate from CA is counted as evidence that the owner of that certificate is trustworthy.
Under these circumstances, i.e. TLS with mutual authentication with single, controlled CA, is a Man In The Middle attack possible without prior possession of a certificate from the CA? Is there any need for additional precautions, such as host-name verification?