1

Given any HTTPS server, say google.com, can we extract the payload/response and the signature for that data?

The purpose would be to make a request, and obtain a data file and a signature that could be checked using the standard certificate authority system.

2

Neither the application data are signed by TLS nor are request/response signed at the HTTP level. And where no signature is no can be extracted. The application data in TLS is protected against modification by a man in the middle though. But this is done with a HMAC where the key is known to both client and server, which means that the client could create HMAC for data sent by the server and thus this can not be used as a proof that the server has send something.

  • Thanks, together with a comment I was able to understand this. – Alexandre Gomes Apr 10 at 21:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.