Question

I’m trying to figure out the SSL handshake process. After reading up on TLS in Wikipedia I’ve seen that

The server sends its Certificate message (depending on the selected cipher suite, this may be omitted by the server)

I’ve also seen such behavior in real-life sniffs, but only in cases where the user eventually received an "Invalid certificate" warning.

I was wondering in which cases can a server omit the certificate? How can the client verify the server’s identity in this case then? Or is it only reserved to cases where the server have no certificate and gives up on sending a fake one, knowing that the user will see a browser warning anyway?

Thanks!

Answer 1

Some cipher suites don’t rely on certificates:

• The anonymous cipher suites, defined in the main TLS RFC (the names containing DH_anon). Some of them can provide encryption, but without authentication, which is insecure. Section A.5 says the following about them:

The following cipher suites are used for completely anonymous
Diffie-Hellman communications in which neither party is
authenticated. Note that this mode is vulnerable to man-in-the-
middle attacks. Using this mode therefore is of limited use: These
cipher suites MUST NOT be used by TLS 1.2 implementations unless the
application layer has specifically requested to allow anonymous key
exchange. (Anonymous key exchange may sometimes be acceptable, for
example, to support opportunistic encryption when no set-up for
authentication is in place, or when TLS is used as part of more
complex security protocols that have other means to ensure
authentication.)

• Kerberos cipher suites, in which case the identification is done via the Kerberos ticket, and the name is verified against the Kerberos principal name (host/MachineName@Realm).

• Pre-Shared Keys cipher suites (see section on PSK Identity Encoding).