While obtaining digital certificate the applicant trusts the certificate authority (or registering authority) as CA is digitally certified (and applicant has CA's public key).
To certify a domain the protocol would go like this:
- I generate my public-private keys and send the authority my public key encrypted by its public key.
- She encrypts a nonce and sends me to put on my website
- As I'm in control of the website I put this nonce and encrypt it with her public key
- She checks and issues me a digital certificate for that site.
Is there a possibility for MIM attack here as follows:
- attacker between me and the CA can pretend to be me and requests certificate for domain I control. He generates his public-private keys
- he intercepts the nonce sent back by the CA
- he mimics my site and puts on the received nonce
- CA issues the certificate to the attacker?