I have been looking at the SSL Certificate Trust Model, and there is something t

Question

I have been looking at the SSL Certificate Trust Model, and there is something that does not make sense. If I am correct, the trust model makes it that if there is a chain of certificates with a trusted root certificate at the top of the chain, all certificates in this chain will be trusted. This does not make sense because then I could create a valid certificate for google.com with my own key pair. I would do this by taking the certificate chain of google.com, lets say Verisign, then google.com. I would leave the root certificate as it is, but modify the key pair in the google.com certificate. This certificate chain would be trusted because the root certificate is trusted, therefore all other certificates are trusted. This would allow you to create a man in the middle attack.

Explanation / Answer

SSL certificates have an extension field that defines what a certificate is allowed to be used for.

When you buy a certificate from VeriSign with your certificate signing request, it typically will not include the extension permission for signing downstream certificates with your certificate; especially for any domain you don't have authority for.

Take google.com for instance (root to leaf node):

1. Equifax Secure CA - Root CA (hence implicit downstream signing authority)
2. GeoTrust Global CA - Has Certificate Signer property
3. Google Internet Authority G2 - Has Certificate Signer property but can only sign leaf nodes
4. *.google.com - Wildcard domain certificate with no authority to sign other certificates.

The browser checks validity from the root to the leaf. Any authority claimed by a leaf or intermediate certificate is assumed to have been authorised by the certificate that signed it; eventually culminating in the trust given to and from the Root Certification Authority.

Related Questions

Navigate

• Browse (All)
• Browse I
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.