18
Is the only protection here that Bob actually checks that the public
key on the returned certificate matches what he originally sent in his
request to the CA?
If the public key was switched before the CA used it to create the certificate, then Bob's web site won't work at all. The private key, which he has kept safe, will only work with his original ...
5
Is it dangerous to add a custom cert authority to a browser?
It is pretty dangerous. The owner of this CA can use it for man in the middle attacks or to impersonate arbitrary web sites since your browser will trust the CA to create certificates for arbitrary sites. Using such attacks he can then intercept your passwords and other sensitive data.
For ...
3
Good question. The certificates of the most trusted CAs are normally included into software install package, e.g. into browser installer, into OS installer, or are preinstalled on device like smartphone. That's why the browser (or some other application) will notice if certificate is really from the specified CA.
3
The checking of the hostname is done in X509_check_host. This function calls the internal function valid_star to make sure that the given wildcard in CN or SAN can actually be used.
This function checks that wildcard-CN/SAN like * or *.com are treated as invalid since they are too broad. *.example.com is instead acceptable. Thus check is done by counting ...
2
Browsers will alert the user if they are presented with a self-signed certificate which they don't trust.
The browser user or system administrator should preempts this scenario and add the self-signed certificate to the browser's trust-anchor store beforehand. That way, the user won't see a warning.
Done this way, users can be informed that if they ever ...
2
Browsers will only accept an invalid certificate - and self-signed is one form of "invalid" - when the user acknowledges the risk and overrides the browser. The specific steps for doing so vary from browser to browser, but they're usually onerous by design - they want the decision to bypass security to be hard, not easy.
2
I agree that self-signed certificates are sufficient, but the CA approach does add some incremental security in how that trust relationship is maintained, especially when you consider the rollover scenario.
Imagine this scenario:
OJones@sp.com sends a public key to TSmith@idp.com and the relationship is established
Two years later, TSmith@idp.com receives ...
2
How does the client get the public key of the certificate authority?
The certificate store is created at (OS/Application) install time, and updated as part of normal secured (OS/Application) updates. Firefox is notable as an application that uses it's own cert store. Because root certificates are pulled from a local store rather than over the network, ...
1
An attacker with enough privileges to put their own root CA in your browser could just steal your information directly, so that "attack" in particular isn't worth worrying about. But yes, if they managed to do that, then your browser would trust their certificates.
Only top voted, non community-wiki answers of a minimum length are eligible
