I was studying PKI the other day and I had a serious thinking about the following question.
What is CSR? - It is a block of encoded text that is given to the CA when applying for an SSL certificate which validates the identity of the requesting party. The process to construct a CSR is,
- A Certificate Request Info value(plain-text) containing Distinguished name has to be filled. i.e. Common Name, Organization, OU, City, State, Email Address and Public Key.
- The above Certificate Request Info value is signed with the subject entity's private key. i.e. Digitally signed.
- The Certificate Request Info value, a signature algorithm identifier, and the entity's digital signature are collected together into a CSR.
So, basically the CSR contains Digitally signed plain-text info about the requesting party, the plain text-info and the Signature Algorithm.
My question is What if the Man-in-the-Middle alters the Email Address in the CSR but actually kept the public key intact?
This way when the CSR reaches the CA, the CA will fetch the public key from the plain-text info and decrypts the signed info thereby assuming that no tampering was done. So, Is there a way to prevent this interception or my understanding is incorrect?