Table of Contents
Encryption ensures that only the client and server know the transferred data. However, somebody can intercept the connection between client and server and can read and change everything from that point onwards (man-in-the-middle-attack). To prevent this from happening, the server authenticates itself to the client with a security certificate when the connection is established.
The server sends its certificate to the client and the client checks it according to 3 criteria:
The certificate is issued by a Certificate Authority known to the client.
The certificate identifies the exact server that the client has connected to. To do this, the client compares the host name it has connected to with the Common Name, (abbreviated CN) in the certificate.
The current time is within the validity period of the certificate.
Only if all three criteria are correct, can the client be sure that it is connected to the correct server and an attack can be ruled out.
A real-world attack could be described as follows: A hacker sits with a normal notebook at a WLAN hotspot at the airport. He uses special software to redirect all WLAN connections via his notebook. If someone wants to establish an encrypted connection, the software presents the user with a different certificate. This certificate has been legally issued by a trusted Certificate Authority on a domain belonging to the hacker. The only thing that can warn the user that the connection is being tapped and manipulated by the hacker is the browser's warning that the website and certificate do not match.
Warnings of incorrect security certificates should therefore never be ignored.