0
$\begingroup$

Is it possible that a client which gets the Digital certificate of the Server during the TLS handshake then acts as a server? Because a server only needs to have a valid digital certificate which it already possesses.

$\endgroup$
1
$\begingroup$

Is it possible that a client which gets the Digital certificate of the Server during the TLS handshake then acts as a server? Because a server only needs to have a valid digital certificate which it already possesses.

Are you asking whether a client can take the certificate it receives from the server, and later pose as that server? No, it cannot - in addition to the certificate, it would also need the private key that corresponds to the public key that's in the certificate. That is, later on in the TLS protocol, the server is required to perform some operation that depends on the private key (which might be decrypting a value encrypted with the public key, or it might be signing some data - which it is depends on the ciphersuite and TLS version).

That private key is not sent through the TLS handshake, and so the client would not be able to perform either of these actions. Hence, just the information that the client learns via the TLS connection is insufficient.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.