Web PKI: Closing the Gap between Guidelines and Practices

Abstract

Abstract-A string of recent attacks against the global public key infrastructure (PKI) has brought to light weaknesses in the certification authority (CA) system. In response, the CA/Browser Forum, a consortium of certification authorities and browser vendors, published in 2011 a set of requirements applicable to all certificates intended for use on the Web and issued after July 1st, 2012, following the successful adoption of the extended validation guidelines in 2007. We evaluate the actual level of adherence to the CA/Browser Forum guidelines over time, as well as the impact of each violation, by inspecting a large collection of certificates gathered from Web crawls. We further refine our analysis by automatically deriving profile templates that characterize the makeup of certificates per issuer. By integrating these templates with violation statistics, we are able to depict the practices of certification authorities worldwide, and thus to monitor the PKI and proactively detect major violations. Our method also provides new means of assessing the trustworthiness of SSL certificates used on the Web.

Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations

“…Large-scale surveys of SSL certificates “in the wild” can be found in [19, 25, 27, 78]. Because their objective is to collect and analyze certificates, not to find certificate validation errors in SSL/TLS implementations, they are complementary to this paper: for example, their certificate corpi can be used to “seed” frankencert generation (Section VII).…”

Deployment challenges in log-based PKI enhancements

“…We assume a rough upper bound of 10 million certificates [6] each representing a unique domain name, though this number will likely be much less since DSFs are only intended to be used during the deployment process. Then for a 1% false positive rate the size of a DSF should be at most 13 MB, which is well below the storage limit of modern client machines.…”

Network-based Origin Confusion Attacks against HTTPS Virtual Hosting

“…We can easily build statistics about the number of domains found in publicly trusted certificates issued between July 2012 and July 2013 based on data collected in [9]. The results, depicted in Figure 6, show that about 40% of issued certificates are valid for a single domain; however, about 10% of them contain a wildcard.…”

“…It is tempting to argue that the fact these domains appear in the same certificate is a clue that their sharing of some TLS session-specific attributes could be acceptable, but we stress that it is in fact not the case. For instance, recall from Section 2 that CloudFlare uses shared certificates that cover dozens of customers' domains [9,35]. In fact, it is common on today's web to connect to a website whose certificate is shared with a malicious, attacker-controlled domain.…”

“…Recent measurement studies of TLS certificate issuance [8,9] show that a majority of newly issued certificates are valid for more than one domain name, with a significant number of them containing at least one wildcard. For example, all the front-end Google servers share a certificate that covers *.google.com as well as 50 other DNS names, many with wildcards.…”