I wonder about one thing, if somebody can perform MITM on arbitrary domains, is there something like certificate pinning to stop impersonating the authorities used for things like this? I remember OCSP being something like that (if I’m not butchering the initialism), where the browser requests confirmation the certificate is currently valid, and the server can pre-fetch this confirmation to send to the client.
Okay, but how do you verify that? In order to check if the certificate was logged, you need to access the log; if somebody can fake certificates and intercept your requests, can they also impersonate the certificate log and fake an entry there? Or is it secured in some additional way?
I wonder about one thing, if somebody can perform MITM on arbitrary domains, is there something like certificate pinning to stop impersonating the authorities used for things like this? I remember OCSP being something like that (if I’m not butchering the initialism), where the browser requests confirmation the certificate is currently valid, and the server can pre-fetch this confirmation to send to the client.
Certificate transparency means that all certificates have to be publically logged.
Okay, but how do you verify that? In order to check if the certificate was logged, you need to access the log; if somebody can fake certificates and intercept your requests, can they also impersonate the certificate log and fake an entry there? Or is it secured in some additional way?