Why does a website present a certificate for a completely different domain? [closed]

Question

The last couple of weeks I have had several websites temporarily present certificates for completely unrelated domains. A visit to docs.oracle.com presented a certificate for an internal service and sub-domain at toyota.com, another visit to a tech-blog at portswigger.net presented a certificate for some payment operator.

What are the possible causes of this, and what are the security implications?

The unrelated certificate chain can be seen here: https://pastebin.com/eFUPh10H and the correct one presented a moment later is here: https://pastebin.com/53cMtnSb

Answer 1

This is likely a side effect of a server reload/restart and/or temporary miscinfiguration. It could also be a load balancer misconfiguration.

Whats likely happening is that multiple sites are hosted on a single IP address - thus requests for different sites are going to a server. Where the server does not know the configuration for a specific site the first site on the server is sometimes shown. If the domain name does not match the name specified in the cert a warning is thrown up.

The warning is working as desired, and there is no real security risk here, unless the viewer does not heed the warning - which would be a security risk for the user regardless. (ie they could fall for a MITM attack). There are arguably obscure edge cases to do with misconfigured load balancers -where in effect someone in control is implementing a mitm attack - but that risk is not very different to an administrator going rogue.