Root Certificates

GHOSTRIDER2016

I understand that SLL certificates in the web browser performs a handshake with the certificate on the web server. To ensure that it can trust the web server. If it doesnt have the root certificate then a warning will be given to the user.

My question is with self signed certificates. What if someone hijacks your self signed certificate and copies it to their own computer does it allow the attacker to break the web server ?

Thanks

docrice

There are lots of nuances to this, but I'll generalize with the understanding I'm not covering all use cases in a single post.

During the SSL/TLS handshake, the web server sends its certificate (and any issuing CA cert(s)) for the client to validate. Validation is based on validity period (start and end dates stamped on the cert), whether the FDQN in the browser matches up with the Common Name value in the cert, among a few other things including whether the trust chain (the server cert and any issuing certificate authority certificates) cryptographically chain up to the issuing root CA certificate, the latter which is supposed to be already stored in your trusted root certification authorities store provided to you by the OS vendor.

The critical component with hijacking in this scenario is whether the attacker has the private key of the web server, the client properly validates the trust chain (bad software implementations have known to happen), or whether the MiTM attack can occur because the attacker presents a dynamically-generated cert which happens to be issued by a CA which is trusted by the client (a la BlueCoat and other enterprise-oriented SSL/TLS interception technologies).

So in the case of a self-signed cert, the attacker generally still needs to have a copy of the private key which corresponds with the public key on the certificate. If the attacker has both the private key and cert and can somehow manipulate the network via routing, ARP spoofing, DNS change, etc., then the interception can take place.