Description

Detects when an SSL certificate is not valid for the accessed domain name, creating a potential man-in-the-middle vulnerability. This occurs when the domain name does not match either the certificate's Subject Alternative Names (SANs) or the wildcard domains covered by the certificate.

Detection Strategy

• Compare the accessed domain name against all valid domain names listed in the certificate's Subject Alternative Names (SANs)

• If the domain doesn't match any SANs directly, check if it's covered by any wildcard certificates (e.g., *.example.com)

• Report a vulnerability if the domain neither matches any direct SANs nor falls under any wildcard certificates