News for hackers. Stuff that matters.

A comment on Malaysia backtracks on DNS redirection decision. Parent comment

Re:Malaysia backtracks on DNS redirection decision by notpushkin on Sunday September 08, 2024 @08:12AM (#41479943)
> sure, your system might try to connect to hijacked IP, but TLS connection will fail due to invalid certificate

I think the parent is asking if malicious actor can issue a certificate in case of BGP hijack. I think they could, but then it would be visible in the CT log.

[ Parent | on HN ]
Re:Malaysia backtracks on DNS redirection decision by commandersaki on Sunday September 08, 2024 @02:28PM (#41482116)
Nah StrLght set me straight. I really didn't know how an IP address was embedded in a certificate, and I was viewing the output of the certificate from the lens of openssl s_client -connect 1.1.1.1:443 which obscures the fact that there's more than CN=cloudflare-dns.com.

I think it'd be pretty hard to get a certificate for 1.1.1.1 after a BGP hijack, unless you had some control over a CA. I don't think LetsEncrypt issues certificates for IPs.

[ Parent | on HN ]