Mutual TLS authentication (mTLS) – what can happen if the clients Certification Authority (CA) gets compromised?

Question

I would like to establish a secure connection between two servers (Alice and Bob) via Mutual TLS authentication.

That means:

• Alice provides Bob a certificate signed by CA
• Bob provides Alice a self-signed certificate (p12)

Suppose Alice’s trusted root CA is compromised and would be able to issue a fraudulent certificate which matches Alice. What would such certificate be able to achieve, specifically about MITM type attacks?

My assumption is that nothing can happen because the attacker (fake Alice) is missing Bob's certificate to establish the connection in the first place. Is that correct?

Thanks!

Answer 1

What would such certificate be able to achieve, specifically about MITM type attacks?

For Bob, the attacker is Alice. The attacker says he is Alice, and gives him Alice's certificate. He will ask Bob for his certificate, and Bob will give him.

A compromised CA means anything signed by that CA is compromised, and useless. Every single issued certificate could be compromised, and you cannot tell if they are legit or forged. A compromised CA is a devastating error. It can put a public CA out of business. A private CA compromise will lead to lots of all-nights for the support team, but a public CA almost surely will be out of business.

And why would Bob use a self signed certificate? Or both uses self signed certificates, and exchange them only once (in person, maybe), or let both use CA issued certificates. This mix does not look well.