Say I have the SSL certificate for google.com. I intercept it, edit the certificate with my own domain name and public key and use it to intercept all traffic to google.com. What mechanisms exist in the SSL certificate to prevent me from doing so?
When a CA signs a certificate they encrypt a hash which includes the host name of the certificate target using their private key. When the client receives the certificate they decrypt the hash using the public key for the CA (which is baked into the client) and check that it matches the hash calculated by the client. If the hashes don't match then validation fails and the connection should be aborted.
- If you modify the certificate to change the host name then the hashes won't match
- If you try and sign the certificate again (ie. replace the hash with your own) then the client won't trust it because it wasn't signed by one of their trusted CAs.
- If you try and present a legitimately signed certificate for another domain then obviously the validation will also fail because the domain doesn't match.