Say, an attacker fakes an original server certificate by a trusted CA using a another certificate from the same CA in a Man-in-the-middle attack. Why can this be detected using subject verification on the client-side?

(I'm not asking about the general workings of the protocol, all it's mechanisms, but, in the framework of those mechanisms, and assuming a general knowledge of TLS, how subject verification specifically prevents a MitM attack, without the need to explain extraneous mechanics of TLS.)

  • 1
    If the attacker has the private key of the certificate of a website, they are 100% indistinguishable from the real website. – MechMK1 Oct 22 '19 at 12:18
  • I'm assuming of course that the compromised certificate is not exactly the servers. Reworded for clarity. – ig-dev Oct 22 '19 at 12:22
  • Then it would be useless. If you have a cert from "SecureCA" for ig.dev, then I can just go and buy a cert from SecureCA for not-ig.dev. It would not get me any closer to being able to impersonate you. What I would need is your certificate (which is public anyways) and your private key (which is the really hard part). – MechMK1 Oct 22 '19 at 12:25
  • Oh, if that's the case I might have to remove this question. Based on your description I can't see how subject verification is of any value then, since you can impersonate either fully, or not at all, it seems. – ig-dev Oct 22 '19 at 12:29
  • No, but there is a question here that accurately describes how TLS works. Once you really understand it (it's not trivial), you can see attack vectors. – MechMK1 Oct 22 '19 at 12:30

Here is my attempt to answer the question, based on my research in the meantime.

The attacker may obtain another certificate from a trusted CA, but he is unable to alter this certificate in any way. The assumption is that the CA will not issue a certificate for the subject under attack to the attacker, since he cannot prove that he owns the subject (domain name).

When the attacker tries to mediate the traffic between the client and server in a MitM attack, he has to present his own certificate to the client, instead of the servers, to be able to eavesdrop on the traffic. If the client performs subject verification, he will see that the attackers certificate does not contain the correct subject, even though his certificate is coming from a trusted CA. This way subject verification can detect MitM attacks.


Not the answer you're looking for? Browse other questions tagged or ask your own question.