4 ms·
> sure, your system might try to connect to hijacked IP, but TLS connection will fail due to invalid certificate I think the parent is asking if malicious acto
by notpushkin 2y ago
> sure, your system might try to connect to hijacked IP, but TLS connection will fail due to invalid certificate
I think the parent is asking if malicious actor can issue a certificate in case of BGP hijack. I think they could, but then it would be visible in the CT log.
- commandersaki 2y agoNah StrLght set me straight. I really didn't know how an IP address was embedded in a certificate, and I was viewing the output of the certificate from the lens of openssl s_client -connect 1.1.1.1:443 which obscures the fact that there's more than CN=cloudflare-dns.com. I think it'd be pretty hard to get a certificate for 1.1.1.1 after a BGP hijack, unless you had some control over a CA. I don't think LetsEncrypt issues certificates for IPs.