3 ms·
> Yes, if I can masquerade as your domain How would you do that? If you could do that you could also masquerade the HTTPS connection and simply run HTTPS at t
by austincheney 8y ago
> Yes, if I can masquerade as your domain
How would you do that? If you could do that you could also masquerade the HTTPS connection and simply run HTTPS at the spoofed server using the spoofed X.509 cert from the legitimate web server.
- icebraining 8y agoYou can't "spoof" a cert, that's its whole point. If you create a new, it won't have a valid signature, and if you copy the original, you won't have the associated private key to create valid responses.
- austincheney 8y agohttps://www.computerworld.com/article/2897815/microsoft-blacklists-fraudulently-issued-ssl-certificate.html https://www.computerworld.com/article/2897815/microsoft-blac... To be more clear a malicious website can rely on fraudulently issued certificates to validate a spoofed domain. This is a bad cert that appears to be valid and establishes the same level of trust. That is why revocation lists and OCSP are necessary.