This question already has an answer here:
- How does SSL/TLS work? 3 answers
My understanding of how it works :
A victim asks for the public key of a server. The attacker just forwards this request. The server now responds with a certificate which contains the Public key. The attacker modifies this to its own public key and sends it to the victim.
Something happens now that I don't understand:
The browser has public keys of all major certificate authorities. It uses this public key to verify that the web server's certificate was signed by the trusted CA? How? An attacker can fake this request just as it did with the server? Apparently the Browser checks if the certificate is valid? Now how does it go by doing this. The attacker can fake data for this so that the Browser check still result to a True.
If the server's privatekey/publickey changes how would a victims browser know that this is changed?
Then the browser generates a shared symmetric key and encrypts it with the attackers key. Therefore the attacker can decrypt it. Get the key. Encrypt it with the servers key and send it off to the server.