3

If I verify the fingerprint of a self-signed SSL certificate on the client, can a man-in-the-middle attack still occur?

Improve this question
3

2 Answers 2

Reset to default
6

Only if they manage to actually reproduce the fingerprint, which is much, much harder.

The Fingerprint is actually the most reliable method of determining a certificate is what it should be. It's just ignored by just about everyone.

Improve this answer
5

A self signed certificate is just as "secure" as a CA issued certificate given the same cryptographic specifications. All the same vulnerabilities and strengths are there.

The only difference is that clients generally have a preconfigured list of trusted CAs and will not ask, where they'll always initially ask for self-signed. Which it sounds like you're already aware of.

Improve this answer
3
  • 1. "All the same vulnerabilities and strengths are there." man-in-the-middle not applicable to vulnerabilities and strengths 2. You did answer on clearly asked question at all. Downvote, ace of diamonds
    – Lazy Badger
    Mar 24, 2012 at 4:40
  • 1
    Erh, no he did answer the question correctly imo. I think you are the one that's talking bs.
    – Lucas Kauffman
    Mar 24, 2012 at 7:33
  • 1
    @LazyBadger I don't think you understand security, perhaps you should read up on MITM attacks and how they can apply to HTTPS communication. My answer implies that using a self signed certificate makes it no more or less likely that a MITM attack can be performed. If you are having trouble understanding you should ask for help.
    – Chris S
    Mar 24, 2012 at 14:20

You must log in to answer this question.