Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
Is there any way to prove that a HTML page was delivered to my browser, and not modified in any way, after it was delivered over TLS?
I need to prove integrity, and authenticity of the sender, ideally by the server's public key.
Is there a tool for it?
I can only find information about the handshake methods, but not for the content delivering.
I want to end with a signed HTML page that can be verified with the server's public key
From what I'm understand, what you're trying to do is to verify, after you are sure that the page arrived from the network untouched (since it's TLS), that it has not be modified by any client-side malware.
Since it's a client-side malware, it's safe to presume it can change anything he wants on the client side, after the session is decrypted from the TLS layer. Then, there is no way for you to be sure the data is intact : even if you add a cryptographic signature, the malware could just change your server's public key in memory and resign the HTML, or simply bypass the signature check.
