Re: AW: IE https certificate attack

[Ben Laurie <ben () algroup co uk>]

K.J.Mueller () EnBW com wrote:
> Hi,
>
> could it be, that the text-browsers (lynx, links, w3m) don't even
> bother comparing the actual server name to the certificate's
> "issued for" entry?
>
> I just tested these and none complained:
>
> - lynx 2.8.5dev.2 (with OpenSSL 0.9.6a)
> - links 0.96
> - w3m 0.1.11-pre
> (all on Mandrake Linux 8.1)
>
> Neither did any of them complain when accessing a https web page
> with a self-made certificate.

They shouldn't complain about the server name (at least, not if its
right) with a self-made cert. However, they should complain about the
cert not using a trusted CA.

Cheers,

Ben.

--
http://www.apache-ssl.org/ben.html