Certificate impersonation is when an attacker presents a fake, stolen, or mismatched certificate to make a client believe it is talking to a trusted server. In TLS, the certificate is part of the server’s identity proof: it must chain to a trusted authority and match the expected hostname. If either check is weak, the client may accept a lookalike endpoint as legitimate.
This matters because encryption alone does not guarantee you reached the right server. In a man-in-the-middle attack, an adversary can intercept traffic and try to substitute their own certificate to terminate TLS and observe or alter data. Defenses include strict certificate validation, hostname verification, certificate pinning where appropriate, and rejecting any certificate whose identity does not match the destination. Security testing should confirm that invalid names, expired certificates, and untrusted issuers are all blocked as expected.