Analysis of the HTTPS certificate ecosystem

By Zakir Durumeric, James Kasten, Michael Bailey, J. Alex Halderman. ACM/SIGCOMM Internet Measurement Conference, 2013

345 citations recorded by the source corpus.

We report the results of a large-scale measurement study of the HTTPS certificate ecosystem---the public-key infrastructure that underlies nearly all secure web communications. Using data collected by performing 110 Internet-wide scans over 14 months, we gain detailed and temporally fine-grained visibility into this otherwise opaque area of security-critical infrastructure. We investigate the trust relationships among root authorities, intermediate authorities, and the leaf certificates used by web servers, ultimately identifying and classifying more than 1,800 entities that are able to issue certificates vouching for the identity of any website. We uncover practices that may put the security of the ecosystem at risk, and we identify frequent configuration problems that lead to user-facing errors and potential vulnerabilities. We conclude with lessons and recommendations to ensure the long-term health and security of the certificate ecosystem.

Subfields: Artificial Intelligence, Computer Networks and Communications, Signal Processing

View Paper: https://www.semanticscholar.org/paper/08fabacc44f1f7d3b968fa41e52e350a24e02abc

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

1. Frank H. Li
2. Dana Dachman-Soled
3. Mathias Payer
4. Michael Bailey
5. J. Alex Halderman
6. Seung Geol Choi
7. Davide Balzarotti
8. Vern Paxson

In Computer Networks and Communications

1. Elias Bou-Harb
2. Nataliia Neshenko
3. Michael Bailey
4. Nasir Ghani
5. Seung Geol Choi
6. Davide Balzarotti
7. Vern Paxson
8. Aurélien Francillon

In Signal Processing

1. Mathias Payer
2. Michael Bailey
3. Davide Balzarotti
4. Vern Paxson
5. Aurélien Francillon
6. Karim Eldefrawy

Citations in the corpus

• A Search Engine Backed by Internet-Wide Scanning (2015, background): “There have been a large number of research studies over the past several years that have been based on Internet-wide scanning [1, 7–11,13,14,18,19,24–29,38], which encouraged us to develop Censys.”
• A survey of methods for encrypted traffic classification and analysis (2015, background): “[30] who mainly focused on assessing certification authorities.”
• The Matter of Heartbleed (2014, methodology): “To track which sites replaced certificates and cryptographic keys, we combined data from our Heartbleed scans, Michigan’s daily scans of the HTTPS ecosystem [29], and ICSI’s Certificate Notary service [22].”
• Differentially-Private Multi-Party Sketching for Large-Scale Statistics (2020, methodology): “Our first data consists of the publicly available University of Michigan internet scan data [23].”
• Demystifying IoT Security: An Exhaustive Survey on IoT Vulnerabilities and a First Empirical Look on Internet-Scale IoT Exploitations (2019, background): “By searching for such certificates in public ZMap datasets [164], the authors located about 35,000 active devices.”
• A Large-Scale Analysis of the Security of Embedded Firmwares (2014, methodology): “By looking up those certificates in the public ZMap datasets [36], we were able to automatically locate about 35,000 active online devices.”