certmitm: Automatic Exploitation of TLS Certificate Validation Vulnerabilities
Aapo Oksman introduces certmitm, an automated tool designed to discover and exploit insecure TLS client certificate validation flaws across iOS, Windows 11, and embedded devices.
Summary
Persistent Insecurities in TLS Client Validation
TLS remains the industry standard for encrypting network communications, yet developers and libraries continually struggle to implement rigorous certificate chain validation in client endpoints.
Introducing the certmitm Tool
Aapo Oksman presents certmitm, an open-source testing framework developed to automatically detect and exploit flawed TLS certificate verification logic during active man-in-the-middle engagements.
Demonstrating Exploits Across Modern Operating Systems
The author demonstrates practical certificate bypass attacks compromising high-profile applications on iOS and Windows 11, illustrating how insecure trust configurations expose encrypted sessions to interception.
Related talks
Cloud Village·12 min
Kevin Chen
Kevin Chen breaks down Public Key Infrastructure (PKI) concepts, removing the intimidation around TLS certificates, trust chains, and cloud CAs.
Presentations Crypto·50 min
Jose Selvi
Jose Selvi demonstrates how manipulating Network Time Protocol (NTP) synchronisation allows bypassing SSL/TLS certificate expiration checks and HSTS protections.
Village Presentations·22 min
Nick Sullivan
Cloudflare head of cryptography Nick Sullivan introduces CFSSL, an open-source Go toolkit for automated TLS certificate authority operations and PKI bundling.