[SSL Observatory] https://controller.mobile.lan

Mon Feb 6 11:42:12 PST 2012

Hi,

I'm at a hotel in Munich and I found a rather funny cert performing a
full MITM for *:443 - https://controller.mobile.lan is signed by VeriSign.

CN = VeriSign Class 3 Secure Server CA - G2
OU = Terms of use at https://www.verisign.com/rpa (c)09
OU = VeriSign Trust Network
O = VeriSign, Inc.
C = US

% openssl x509 -text -in cert.lan
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            69:53:ea:07:6d:f0:6c:9c:17:e8:66:0d:39:c5:6a:8e
        Signature Algorithm: sha1WithRSAEncryption
        Issuer: C=US, O=VeriSign, Inc., OU=VeriSign Trust Network,
OU=Terms of use at https://www.verisign.com/rpa (c)09, CN=VeriSign Class
3 Secure Server CA - G2
        Validity
            Not Before: Aug  6 00:00:00 2010 GMT
            Not After : Aug  5 23:59:59 2012 GMT
        Subject: C=DE, ST=Lower Saxony, L=Lueneburg, O=Securepoint GmbH,
OU=NAC Support, OU=Terms of use at www.verisign.com/rpa (c)05,
CN=controller.mobile.lan
        Subject Public Key Info:
            Public Key Algorithm: rsaEncryption
            RSA Public Key: (1024 bit)
                Modulus (1024 bit):
                    00:c4:26:1b:81:a0:5d:8a:c8:e5:2f:59:b8:4e:72:
                    f5:fb:9b:26:22:f6:cb:dd:c5:74:d1:4b:af:83:5d:
                    04:83:74:d6:9c:48:6a:94:f6:4f:d9:33:24:1b:ec:
                    0e:98:fc:1e:e8:d2:df:95:01:3a:3f:27:8c:8a:a6:
                    46:2b:36:84:3a:5e:d7:a4:5d:70:38:11:48:0d:94:
                    c2:f8:af:f8:3d:a8:10:22:ee:13:ae:16:63:dd:4e:
                    c2:9c:05:cc:41:eb:23:5d:79:65:0e:28:c3:0d:37:
                    5c:d8:83:a3:5b:f0:56:7c:5f:4b:28:f7:ed:d1:96:
                    e7:0d:ca:b9:af:34:b6:6f:43
                Exponent: 65537 (0x10001)
        X509v3 extensions:
            X509v3 Basic Constraints:
                CA:FALSE
            X509v3 Key Usage:
                Digital Signature, Key Encipherment
            X509v3 CRL Distribution Points:
                URI:http://SVRSecure-G2-crl.verisign.com/SVRSecureG2.crl

            X509v3 Certificate Policies:
                Policy: 2.16.840.1.113733.1.7.23.3
                  CPS: https://www.verisign.com/rpa

            X509v3 Extended Key Usage:
                TLS Web Server Authentication, TLS Web Client Authentication
            X509v3 Authority Key Identifier:

keyid:A5:EF:0B:11:CE:C0:41:03:A3:4A:65:90:48:B2:1C:E0:57:2D:7D:47

            Authority Information Access:
                OCSP - URI:http://ocsp.verisign.com
                CA Issuers -
URI:http://SVRSecure-G2-aia.verisign.com/SVRSecureG2.cer

            1.3.6.1.5.5.7.1.12:

0`.^.\0Z0X0V..image/gif0!0.0...+......Kk.(.....R8.).K..!..0&.$http://logo.verisign.com/vslogo1.gif
    Signature Algorithm: sha1WithRSAEncryption
        22:e1:4d:97:e0:9b:7e:6a:3e:19:6b:b8:a7:cf:ff:b8:e3:ba:
        29:76:ea:96:d3:8e:09:f6:76:9d:ff:11:8c:1e:f1:36:f8:b4:
        b9:01:37:f4:dc:9f:21:f0:de:03:bc:be:34:d5:bc:b3:df:cd:
        bb:0c:56:53:f5:ec:3d:8a:ed:bc:39:eb:93:b2:de:a8:18:58:
        6a:33:7d:78:e9:f9:ce:38:2f:cf:14:1e:5d:3a:47:f3:4d:16:
        48:1b:78:c1:60:b8:f3:c6:60:03:bb:60:b7:2e:a0:e1:12:5f:
        04:e9:3b:54:92:c7:9e:24:fd:e5:9c:c4:3b:9f:71:76:32:55:
        af:a8:42:b2:30:6c:b0:8c:95:a3:5b:c1:ed:69:c1:40:5c:23:
        c1:82:46:b0:a9:cc:05:ed:5c:5e:c5:0b:06:ca:c3:29:19:5f:
        95:d0:67:55:ef:fa:8b:82:ef:3e:61:12:20:cd:6e:0c:b9:bf:
        b2:e2:8f:63:93:0a:f2:64:a5:a1:f8:0c:5c:f8:69:63:34:5f:
        b5:72:7b:a4:32:b5:4c:4e:0e:41:6e:9f:4c:1c:66:0a:57:f8:
        1d:c9:53:50:3c:64:43:d0:2e:a8:ae:5a:00:1c:dd:86:97:ea:
        26:d7:ae:e1:80:ab:38:28:6c:1d:cf:79:5b:dc:d6:f1:d1:72:
        94:80:c9:7d

Here's the cert: