0

I know HTTPS is based on the Certificate Authority (CA). If a client tries to send a request to a server (Assuming there is a Certificate), is it possible that a middleman can take the certificate from client and get the public key from the CA? At the same time, the middleman gives a fake Certificate to the Client and when the client sends a Certificate to CA, the middleman again intercepts it and give him fake public key.

I hope my question is clear enough. Thanks.

1
  • Public keys and certicates are always public, while the private key is keept private and never sent.
    – NiKiZe
    Oct 29, 2021 at 9:22

1 Answer 1

4

Under normal circumstances the client doesn't connect to the CA when making a HTTPS (or any other TLS) connection, they have a local copy of all the CA certificates they trust to issue server certificates.

So the client connects to the server, which sends the client a copy of it's server certificate, this contains a hash signed by the CA's private key, which is checked with the client's local copy of the CA's public key.

Not the answer you're looking for? Browse other questions tagged .