Changes

#  In 2011, the Comodo certificate authority (CA) was targeted by a phishing attack, which resulted in the issuance of rogue digital certificates for several high-profile domains, such as Google, Skype, Yahoo and others. The attacker was able to obtain the private key of the certificate authority, which allowed them to issue fake certificates. This incident highlighted the importance of proper security controls and diversifying the trust infrastructure. Relying on a single CA left the organization vulnerable to attack, as the attacker was able to use the compromised CA to issue fake certificates that were trusted by web browsers and other clients. This incident prompted the industry to review their practices and move towards a more robust trust infrastructure, with multiple CAs in place to reduce the risk of a similar attack occurring.<ref>"Fraudulent certificates issued by Comodo, is it time to rethink who we trust? ", 2011, https://nakedsecurity.sophos.com/2011/03/24/fraudulent-certificates-issued-by-comodo-is-it-time-to-rethink-who-we-trust/</ref>

#  In 2011, the Comodo certificate authority (CA) was targeted by a phishing attack, which resulted in the issuance of rogue digital certificates for several high-profile domains, such as Google, Skype, Yahoo and others. The attacker was able to obtain the private key of the certificate authority, which allowed them to issue fake certificates. This incident highlighted the importance of proper security controls and diversifying the trust infrastructure. Relying on a single CA left the organization vulnerable to attack, as the attacker was able to use the compromised CA to issue fake certificates that were trusted by web browsers and other clients. This incident prompted the industry to review their practices and move towards a more robust trust infrastructure, with multiple CAs in place to reduce the risk of a similar attack occurring.<ref>"Fraudulent certificates issued by Comodo, is it time to rethink who we trust? ", 2011, https://nakedsecurity.sophos.com/2011/03/24/fraudulent-certificates-issued-by-comodo-is-it-time-to-rethink-who-we-trust/</ref>

== Fraudulent certificates in a Man-in-the-middle (MITM) attack ==

== Summary of a Man-in-the-middle (MITM) attack ==

Here are general steps that an attacker might take to execute a man-in-the-middle (MITM) attack using fraudulent certificates:

Here are general steps that an attacker might take to execute a man-in-the-middle (MITM) attack using fraudulent certificates:

# Obtain or create a fraudulent digital certificate: The attacker may create a fraudulent digital certificate by mimicking the appearance and details of a legitimate certificate, or by compromising a legitimate certificate authority (CA) to issue a fraudulent certificate.

# Obtain or create a fraudulent digital certificate: The attacker may create a fraudulent digital certificate by mimicking the appearance and details of a legitimate certificate, or by compromising a legitimate certificate authority (CA) to issue a fraudulent certificate.