发现一个假冒的 gg 证书

发现一个假冒的 google 站，而且还有正规签名的证书，不过认真看了下，应该是假冒的。导出的证书如下:

begin-encoded 644 LW0=
M,((#PC""`JJ@`P(!`@((=F3W@\-FX=@P#08)*H9(AO<-`0$+!0`P23$+,`D&
M`U4$!A,"55,Q$S`1!@-5!`H3"D=O;V=L92!);F,Q)3`C!@-5!`,3'$=O;V=L
M92!);G1E<FYE="!!=71H;W)I='D@1S(P'A<-,3<Q,#`S,3<T.3$Y6A<-,3<Q
M,C(V,3<T-#`P6C!H,0LP"08#500&$P)54S$3,!$&`U4$"`P*0V%L:69O<FYI
M83$6,!0&`U4$!PP-36]U;G1A:6X@5FEE=S$3,!$&`U4$"@P*1V]O9VQE($EN
M8S$7,!4&`U4$`PP.=W=W+F=O;V=L92YC;VTP63`3!@<JADC./0(!!@@JADC.
M/0,!!P-"``0B,]2]PT./O3VO7F+0QRY?MSP3!HHZ5HD[-Y(9R:=@$]/(VYRG
M.[Y6]A6]Q`T5)^FK@W.CPF`$84_HHM^@:5KZHX(!6#""`50P'08#51TE!!8P
M%`8(*P8!!04'`P$&""L&`04%!P,",`L&`U4=#P0$`P('@#`9!@-5'1$$$C`0
M@@YW=W<N9V]O9VQE+F-O;3!H!@@K!@$%!0<!`01<,%HP*P8(*P8!!04',`*&
M'VAT='`Z+R]P:VDN9V]O9VQE+F-O;2]'24%',BYC<G0P*P8(*P8!!04',`&&
M'VAT='`Z+R]C;&EE;G1S,2YG;V]G;&4N8V]M+V]C<W`P'08#51T.!!8$%,<-
M`;(^+WW3KNBSV9I?S%R;TER@,`P&`U4=$P$!_P0",``P'P8#51TC!!@P%H`4
M2MT&%AN\]FBU=O6!MKMB&KI:@2\P(08#51T@!!HP&#`,!@HK!@$$`=9Y`@4!
M,`@&!F>!#`$"`C`P!@-5'1\$*3`G,"6@(Z`AAA]H='1P.B\O<&MI+F=O;V=L
M92YC;VTO1TE!1S(N8W)L,`T&"2J&2(;W#0$!"P4``X(!`0"*UA8]A+16Z,K7
M1C8[N*WTV.`$XDU&.^1+.I>7M9#^Z`F#*"/I8#"7M0E>E0>F(/CQ(&LLSL=>
MI;O"+G\HED.*"`\-W=G3/9PYYTLY]%A])TMRUK[R7>0S!?4)/TCG:.+C-==[
MX(^29\7O`8:WDN-V6R%IXLDK':-`N["7('`GAN9')@!P'SS0LG\2##N31DBL
M7H`>HGT^W2DO'Z05<(U&[RZN\0CO9G%!P4GSK@46:"\M\X(2YH?>H%M^>V.!
MP,G\.$B2:SR1"\48]Z<C/%GM=-8T3H^BH8O\?_LVT.@#C"1K/1\.!WPW[1=*
5(ER5F"T:I[#%%08%$/6U@6+@64VC
`
end

请用 uudecode 还原分析。

Shura

2017-10-19 23:39:53 +08:00

curl -v https://MTgzLjIwNy4xMjkuMTQ=，
* TLSv1.2 (OUT), TLS alert, Server hello (2):
* SSL certificate problem: self signed certificate
* Marked for [closure]: Failed HTTPS connection
* multi_done
* Closing connection 0
* The cache now contains 0 members
* TLSv1.2 (OUT), TLS alert, Client hello (1):
* Expire cleared
curl: (60) SSL certificate problem: self signed certificate
More details here: https://curl.haxx.se/docs/sslcerts.html
这个 IP 用的不是楼主发的证书