When there is a proxy intercepting the communications, the client will make the negotiation with the proxy instead of the server, so the proxy will be the one who sends his certificate to the client. Before establishing the SSL connection, the client and the server negotiate the ciphers and exchange the keys and certificates. The main problem of only checking the chain of trust and the hostname of the certificte is that the browser trust CA or devices trust store can be easly compromised.Ī MITM attack is when the attacker is able to intercept the communications between the client and the server. What it doesn’t check is if the certificate in question is the expected certificate.
Server sends his certificate and public key.Client requests to the server an encrypted session and sends his cipher suites.
The following image is a summary of the handshake:
The handshake determines what cipher suite will be used to encrypt their communications, verifies the server, and establishes that a secure connection is in place before beginning the actual transfer of data. SSL HandshakeĮvery SSL/TLS connection begins with a “handshake” – the negotiation between two parties that nails down the details of how they will proceed. In this post I will explain how SSL handshake works, what is certificate pinning and mutual authentication and how an attacker can bypass these controls.
0 kommentar(er)
