3 ms·
Wouldn't having the private cert allow you to decrypt all communications encrypted using that cert?
by jstalin 13y ago
Wouldn't having the private cert allow you to decrypt all communications encrypted using that cert?
- michaelt 13y agoTraditionally you generate an SSL public and private key, and send only the public key to the certificate authority for signing, so compromising the certificate authority doesn't give you the private key. It does however give you the ability to issue yourself new public keys to conduct man-in-the-middle attacks [1]. If you compromise the same CA as the site whose traffic you're trying to intercept, you can bypass certificate pinning which is supposed to detect MITM attacks. So for example you can MITM gmail without certificate pinning detecting it if you compromise Verisign, Equifax or GeoTrust [2] [1] http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on-attempted-man-in-middle.html http://googleonlinesecurity.blogspot.co.uk/2011/08/update-on... [2] http://src.chromium.org/viewvc/chrome/trunk/src/net/http/transport_security_state_static.json http://src.chromium.org/viewvc/chrome/trunk/src/net/http/tra...