0

The last couple of weeks I have had several websites temporarily present certificates for completely unrelated domains. A visit to docs.oracle.com presented a certificate for an internal service and sub-domain at toyota.com, another visit to a tech-blog at portswigger.net presented a certificate for some payment operator.

What are the possible causes of this, and what are the security implications?

The unrelated certificate chain can be seen here: https://pastebin.com/eFUPh10H and the correct one presented a moment later is here: https://pastebin.com/53cMtnSb

1
  • Unfortunately questions about other sites (in this case Oracle and Toyota) and not about your own website, are considered off-topic here. [Web Applications] (webapps.stackexchange.com) would be a better place to ask this. If you have another question that relates to a site of yours or one that you manage, we'd love to help out! Nov 26, 2021 at 19:53

1 Answer 1

1

This is likely a side effect of a server reload/restart and/or temporary miscinfiguration. It could also be a load balancer misconfiguration.

Whats likely happening is that multiple sites are hosted on a single IP address - thus requests for different sites are going to a server. Where the server does not know the configuration for a specific site the first site on the server is sometimes shown. If the domain name does not match the name specified in the cert a warning is thrown up.

The warning is working as desired, and there is no real security risk here, unless the viewer does not heed the warning - which would be a security risk for the user regardless. (ie they could fall for a MITM attack). There are arguably obscure edge cases to do with misconfigured load balancers -where in effect someone in control is implementing a mitm attack - but that risk is not very different to an administrator going rogue.

1
  • Great explanation!
    – Big Tuna
    Nov 27, 2021 at 14:32

Not the answer you're looking for? Browse other questions tagged or ask your own question.