Re:MITM on HTTPS traffic in Kazakhstan
by u801e on Thursday July 18, 2019 @06:21PM
(#20474502)
> Using CAs to authenticate clients is subject to the same attack.
You don't need to use a publicly available CA to verify client-side certificates. The server could use its own internal CA to sign CSRs from clients and send the reslting certificate back to the client via email or some other means.
Re:MITM on HTTPS traffic in Kazakhstan
by PeterisP on Thursday July 18, 2019 @07:45PM
(#20475065)
In which case the MITM will be unable to connect to the server because it won't have the certificate (that you sent via email or some other means), so the service simply won't work. That's the whole point, you either go through MITM or not at all.
You don't need to use a publicly available CA to verify client-side certificates. The server could use its own internal CA to sign CSRs from clients and send the reslting certificate back to the client via email or some other means.