0

For example: User accessed to my web through SSL wih MYCERT. Suddenly hacker break this session, set proxy between user and my web . User connected again over restored session through HACKERCERT. How I verify my trusted cerficate on every new SSL session? Is it possible?

3

That should never happen. User is requesting your site via https://example.com. The user's browser will expect the server to provide a cert with hostname of example.com. Hacker can not MITM that as hacker will not have the example.com private key to sign a message and authenticate as example.com. User's browser will report an severe warning. If hacker supplies a cert and signature for hostname hackercert.com the browser will warning the hostname is incorrect. If hacker supplies no cert the browser will report server is not available. If hacker suppliers proper cert and invalid signature browser will report there is a problem with the cert.

So the scenario you describe can't happen which is a good thing because if the hacker is MITM you can't do anything the hacker doesn't want you to do. The hacker is between the client and you. So even if there was a "reverify this cert because the other one is bad" command why would the hacker ever let the client see it?

So my guess is either you have a misunderstanding of TLS or I have a misunderstanding of your question.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.