Here’s what I perceive about how shoppers belief the tcp channels they’re linked to.

1. Alice asks Bob for his certificates, signed by a CA’s personal key
2. Bob sends the certificates, which incorporates his frequent identify (area or ip) and an connected signed model of it.
3. Alice makes use of her native public key from the CA to decrypt the signed model and compares it to the certificates to confirm Bob’s claims.
4. If it checks out, if it is equal, the tcp layer she is linked to does certainly have Bob on the different finish.

Or does it? Could not an ISP simply intercept and alter all communications to Bob by means of a proxy setup only for him inside a community change? Together with sending and receiving the certificates to Alice? Bob’s communications already undergo community switches, that is the place his IP really lives. An ISP may simply inject software program proper in there to do no matter as if it was Bob and nobody would know.

Moreover, the entire course of might be compromised at each stage, from the second Bob requests a CSR from a CA.