1

Let's suppose I go to https://www.example.com using Tor. I check that the URL is correct, and the lock icon is present. But the exit node could be run by an adversary who uses a MITM attack and intercepts all the traffic. I download the SSL cert, then download the SSL cert from the same webpage, not through Tor, and do a binary comparison. Or else I compare the cert's serial number and SHA-256 fingerprint. If they match, can I be guaranteed the website viewed through Tor is legit? Or can those details be faked?

I am assuming the genuine cert for example.com has not been compromised.

I looked at plugins like convergence, but my questions relates specifically to checking the cert manually.

Improve this question
1
  • I'm working on integration for Perspectives project into Tor toolchain, you can use it in your web browser.
    – Alexey Vesnin ♦
    Commented Nov 23, 2015 at 1:30

1 Answer 1

Reset to default
1

You can see the certificate information and export the cert:

Click the lock,
More Information,
Security,
View Certificate,
Details,
Export.

You don't need to download two certificates and compare them (but you can if you want to). Export the cert as a file and then:
openssl x509 -noout -text -in filename ; where filename is the cert you exported.
You can also check the serial number and fingerprint at online ssl cert checkers.

The exit node should not be able to fake a cert for the domain you're connecting to.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .