0

If I request the Cert from example.com and the server answers with the (legit) certificate from notexample.com, will the browser throw an error?

2 Answers 2

4

The Web browser is indeed supposed to complain loudly if the intended server name (the one from the target URL) does not appear at a suitable place in the server certificate (normally as a Subject Alt Name extension of type dNSName). See RFC 2818, section 3.1.

In practice, modern browsers emit very conspicuous warnings, often scary and red. Some browsers allow to "click through" the warning with more or less ease (but, of course, you should not do that).

2
  • Even if the site has HSTS enabled? Jun 11, 2015 at 20:42
  • 1
    When using HSTS, browsers are supposed to reject the connection attempt for any error, and not let the user bypass the warning; however, browser vendors have repeatedly shown that in many case, they can consider standards as mere guidelines, and get away with not honouring them. Therefore, whether HSTS really works as intended remains to be seen. Jun 11, 2015 at 20:53
1

Depends on your browser.

Most will let you bypass it. (Unless you've also got HSTS for that domain.)

You can try it yourself:

Edit 2015-06-12: Bugfix. Intermediate step added. This was needed so that the browser would have a chance to be aware that there was an HSTS rule. Otherwise the browser is unable to tell that anything is violated in the next step. (This intermediate step may not be necessary in the future anymore, because badssl.com has applied for inclusion on the HSTS preload list. But that won't happen before Chrome 44 or Firefox 41.)

2
  • Very usefull, Chrome 43 lets me bypass both. Jun 11, 2015 at 23:31
  • @RalfKeller: My bad. The preload will only work on Chrome 44 and upwards. Since you are using 43, the site is not in the preload set. And your browser doesn't know yet that the site uses HSTS. So you will need to use the intermediate step (I just added that). After that your browser will remember that the site is HSTS. Jun 12, 2015 at 13:31

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .