4 ms·
> The domain is there in the certificate itself. With TLS 1.3, the certificate is in the encrypted portion of the handshake.
by cesarb 9y ago
> The domain is there in the certificate itself.
With TLS 1.3, the certificate is in the encrypted portion of the handshake.
- jakobdabo 9y agoThat's nice to hear. I stand corrected, thank you.
- dingaling 9y agoHowever as I understand the protocol the very first step of the TLS 1.3 handshake, the nonce generation, can be MiTMed sufficiently to allow an attacker to determine the target domain. It's only in the next step that server and client do authentication. The attacker can't trivially continue the handshake beyond that point but that might give enough info to log the attempt and terminate the connection.
- MertsA 9y agoOr just connect up a second connection and see what certificate they send back.