Nokia is not faking certs. The "browser" only talks to .browser.ovi.com and the SSL certs are issued to .browser.ovi.com. SSL is working exactly as they should.

Nokia is not faking certs. The "browser" only talks to .browser.ovi.com and the SSL certs are issued to .browser.ovi.com. SSL is working exactly as they should. The "security researcher" didn't understand the results he was seeing and freaked out. The Nokia phone only does a DNS lookup of .browser.ovi.com, it only connects to .browser.ovi.com, and it only gets an SSL cert from .browser.ovi.com. Here is post from the "security researcher", so you can see who the certs are issued to: http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/ http://gaurangkp.wordpress.com/2013/01/09/nokia-https-mitm/