0

I've read other some articles (including this: https://medium.com/@technospace/tls-handshake-under-the-hood-79d20c0020de) and similar questions but none exactly like this hypothetical scenario.

What if there is a "man in the middle" between the client and the certification authority and the same MITM is also between Client and server?

Consider the following scenario:

Client <--> MITM <--> Server

  1. MITM gets the authentic certificate from the Server with Server's public Key
  2. MITM uses the authentic certificate to create a new version of the certificate containing its own (MITM) public key and sends it to the client.

Client <--> MITM <--> Certification Authority

  1. Then Client send request to Certification Authority to validate the forged certificate.
  2. MITM intercepts it this request, sends the original (authentic) version it received from the server to the Certification Authority.
  3. Certification Authority responds saying that the certificate is valid.
  4. Client now believes the public key of the MITM is the server public key.
  5. Since client will now use the MITM public key to encrypt the messages to the server, MITM can use its private key to decrypt all the messages from client to server.

Since this obviously does not happen, what am I missing?

Thanks

  • "MITM uses the authentic certificate to create a new version of the certificate containing its own (MITM) public key and sends it to the client." -- how? "Then Client send request to Certification Authority to validate the forged certificate." -- are you sure this is part of the process? – schroeder Jul 03 '21 at 17:00
  • You have a big assumption about the role of the CA and that it is active in the client handshake process. Check out the answer https://security.stackexchange.com/a/20847/6253 and the Certificates section. – schroeder Jul 03 '21 at 17:03

0 Answers0