I would like to establish a secure connection between two servers (Alice and Bob) via Mutual TLS authentication.

That means:

  • Alice provides Bob a certificate signed by CA
  • Bob provides Alice a self-signed certificate (p12)

Suppose Alice’s trusted root CA is compromised and would be able to issue a fraudulent certificate which matches Alice. What would such certificate be able to achieve, specifically about MITM type attacks?

My assumption is that nothing can happen because the attacker (fake Alice) is missing Bob's certificate to establish the connection in the first place. Is that correct?


  • TLS provides the public key in the initial handshake, so if an attacker is in a position to manipulate traffic they can force a reconnect and get the public key. Compromise of a CA is game over. – Steve May 7 at 15:02

What would such certificate be able to achieve, specifically about MITM type attacks?

For Bob, the attacker is Alice. The attacker says he is Alice, and gives him Alice's certificate. He will ask Bob for his certificate, and Bob will give him.

A compromised CA means anything signed by that CA is compromised, and useless. Every single issued certificate could be compromised, and you cannot tell if they are legit or forged. A compromised CA is a devastating error. It can put a public CA out of business. A private CA compromise will lead to lots of all-nights for the support team, but a public CA almost surely will be out of business.

And why would Bob use a self signed certificate? Or both uses self signed certificates, and exchange them only once (in person, maybe), or let both use CA issued certificates. This mix does not look well.

| improve this answer | |
  • Appreciate your help! Thanks. What happens if both use a different CA? If Alice tries to connect to Bob, he is going to ask the CA if Alice is trustworthy and learns that she is fake. Or am I wrong? I still have trouble to grasp the concept because only one certifcate is compromised hence a connection shouldn't be possible. – Stefan Diabo May 7 at 16:43
  • It does not matter the CA emitting the certificate. Bob and Alice will have a list of trusted CAs (and a copy of their certificates), and if the incoming certificate is signed by a CA on the list, it's accepted. They don't talk to the CA. – ThoriumBR May 7 at 16:59

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.