4

How can I validate, that the cert certifies exactly that key? A certificate does not "certify" a key. What you describe is to check if the private key matches the public key in the certificate and thus can be used to prove ownership of the certificate against a third party. And yes, it is enough for this to check that the public key you have in the key pair ...


3

It all points back to DNSSEC being the culprit but I can't be sure. DNSSec just protects the DNS records against manipulation. The error message instead stems from the certificates subject not matching the domain name used for accessing the system. These two things are unrelated.


3

If I connect to a WIFI AP and it wants to install a root cert. They read my HTTPS traffic, Right? Yes, they can read all of your HTTPS traffic including all of your passwords to any sites you log in to, all of your emails if you load your email, your credit card number if you buy something, etc. And it isn't read-only - it can tamper with them too, ...


2

First, 7.4.1.1 states: Each cipher suite defines a key exchange algorithm, a bulk encryption algorithm (including secret key length), a MAC algorithm, and a PRF. .... My naive understanding is that all the algorithms required are right here in this exchange. No. A (pre-TLS1.3) ciphersuite defines many of the algorithms used, but not all. ...


1

The risk is that all those websites share a public key and private key. That means that any of those sites could impersonate / man-in-the-middle another and you would still get the HTTPS padlock. For example, you could be browsing newrepublic.com, but if somehow your traffic was actually going to robertwalters.cn, your browser would have no way to tell. ...


1

Now if the mobile application is trusting any certificate issued by Digicert then you can effectively MiTM? Am I missing something? Pinning against a CA does not mean that every certificate from this CA will be trusted for a site but that only certificates issued by this CA will be considered to be trustable in the first place. CA pinning does not disable ...


1

Pinning a Root CA can prevent risks posed by other trusted Root CAs in the default certificate store. As mentioned in the link you shared (thank you), it's a deployment decision as to how high (or low) in the chain you would pin the certificate. Check out this Security.SE post for more information for the underlying threat and some mitigations.


Only top voted, non community-wiki answers of a minimum length are eligible