Applied Cryptography
In TLS certificate validation, besides the chain of signatures and the validity period, the client checks that the host name it is connecting to is included in the SAN (subject alternative name) of the certificate. Which of the following is the reason this check is indispensable?
- AAn attacker can also obtain a legitimate certificate from a trusted certificate authority for a different domain name that the attacker owns
- BWithout checking the host name, the communication would not be encrypted at all
- CA certificate whose host name does not match always has a broken chain of signatures, so it would not pass validation in the first place
Show answer and explanation
Answer: A. An attacker can also obtain a legitimate certificate from a trusted certificate authority for a different domain name that the attacker owns
Even if a certificate's signatures are valid and it has not expired, it is meaningless unless the client checks which domain name the certificate is for. An attacker can obtain a legitimate certificate for a domain name the attacker owns just by showing control of that domain. So a client that does not check the host name will accept a fake server presenting that certificate as genuine. In programs that use TLS on their own, the mistake of running with host name verification disabled is a well-known cause of vulnerabilities.
- A. Correct. That the chain is valid and that the certificate is for the host being connected to must be checked separately.
- B. Encryption takes place even without checking the host name. However, a fake peer would go unnoticed, and the encryption would be with that fake.
- C. A legitimate certificate obtained by an attacker also has a chain that validates correctly. That is exactly why the host name must be checked.