- If an attacker would have access to a certificate, could he build an attack out of that?
or rephrasing it:
How could an attacker profit from a device certificate, that he gets his hands on?
For example: A certificate that is used for a device (IoT-Device) gets public, which is in my mind part of the idea of using it, could an attacker profit from that? For example clone it for a different device. Deleting or making the certificate invalid is not an attack in scope in this scenario.
- the private-key is still safe
- the CA oder ICA that signed the certificate is valid and secure
- Data in the certificate is not confidential, but there is an ID for the device
- the attacker is in possession of the certificate file
And following out of that question, if the answer is no, there is no threat.
- I could store the certificate on the device, without thinking to much about security (except deletion and changes that lead to invalid behavior)?