Re: DCM cert for Apache settings

[Tim Bronski <tim.bronski@xxxxxxxxx>]

With self-signed certs the onus is on the client to APPROVE the cert. If 
you know where the certificate came from and can verify it when you 
approve it then it's as good as any CA signed cert. DNS spoofing is moot 
since the spoofed server doesn't have the matching key. CA tree checking 
is just a different way of finding someone who can vouch for the 
certificate.


On 3/9/2017 4:14 PM, Rob Berendt wrote:
> Let's say amazon.com is normally 208.1.2.3
>
> I hack your dns and it now thinks that amazon.com is 208.4.5.6.
>
> We are NOT talking about redirects which take you from amazon.com to
> fraud.com!  Your URL still says amazon.com even though you are going to
> the wrong IP address.  And what user verifies the IP address?  Now, if
> your browser allows self signed certificates then I simply selfsign a new
> certificate to amazon.com and put it on my fraudulent 208.4.5.6 site.
> Then, as far as you know you are at the real amazon.com
>
> Ok, internally.  I know that if I go to corp.dekko.com it should be an
> internal site.  That should be safe, right?  On there you enter a user and
> password and look at your W2 information.  So now I hack our DNS and point
> it to an outside address with a selfsigned certificate and as far as you
> know you're still using the internal site, right?  Again, what user checks
> the IP address?  After all, the URL still says corp.dekko.com, right?
> Again, we are NOT talking about redirects!  This is why many sites do not
> even allow them to work internally.  Because you may say it's internal and
> should be trusted.  But that can easily be hacked.
>
>
> Rob Berendt