alt Hacker NewsAn attacker absolutely cannot “easily distinguish” between a git clone and visiting the website and swap the certificate.
To know whether a request is a git client or web browser, an attacker needs to be able to inspect the contents of the web request (to check the user agent or whatever). If the site is using a legitimate certificate, the attacker has no way to inspect the contents because it is encrypted with a key they do not control.
If an attacker used their own, eMudhra-signed certificate, it would throw the certificate error in Safari.
Yes, I'm assuming network MITM and DPI.
The whole point of TLS and certificates is to counter network MITM attacks.
Browsers and clients emit a lot of fingerprints, you can probably figure it out loosely from the TLS initialisation.