@inproceedings{55d8db5e782e4e728f7691fc3becd276,
title = "Tracking Certificate Misissuance in the Wild",
abstract = "Certificate Authorities (CAs) regularly make mechanical errors when issuing certificates. To quantify these errors, we introduce ZLint, a certificate linter that codifies the policies set forth by the CA/Browser Forum Baseline Requirements and RFC 5280 that can be tested in isolation. We run ZLint on browser-trusted certificates in Censys and systematically analyze how well CAs construct certificates. We find that the number errors has drastically reduced since 2012. In 2017, only 0.02% of certificates have errors. However, this is largely due to a handful of large authorities that consistently issue correct certificates. There remains a long tail of small authorities that regularly issue non-conformant certificates. We further find that issuing certificates with errors is correlated with other types of mismanagement and for large authorities, browser action. Drawing on our analysis, we conclude with a discussion on how the community can best use lint data to identify authorities with worrisome organizational practices and ensure long-term health of the Web PKI.",
keywords = "Baseline Requirements, Certificates, Compliance, HTTPS, PKI, RFC 5280, TLS",
author = "Deepak Kumar and Zhengping Wang and Matthew Hyder and Joseph Dickinson and Gabrielle Beck and David Adrian and Joshua Mason and Zakir Durumeric and Halderman, {J. Alex} and Michael Bailey",
note = "Funding Information: The authors thank Jonathan Rudenberg and Rob Stradling for their help and feedback. This work was supported in part by the National Science Foundation under awards CNS 1530915, CNS1518741, CNS1409505, and CNS1518888. Funding Information: The authors thank Jonathan Rudenberg and Rob Stradling for their help and feedback. This work was supported in part by the National Science Foundation under awards CNS 1530915, CNS 1518741, CNS 1409505, and CNS 1518888. Publisher Copyright: {\textcopyright} 2018 IEEE.; 39th IEEE Symposium on Security and Privacy, SP 2018 ; Conference date: 21-05-2018 Through 23-05-2018",
year = "2018",
month = jul,
day = "23",
doi = "10.1109/SP.2018.00015",
language = "English (US)",
series = "Proceedings - IEEE Symposium on Security and Privacy",
publisher = "Institute of Electrical and Electronics Engineers Inc.",
pages = "785--798",
booktitle = "Proceedings - 2018 IEEE Symposium on Security and Privacy, SP 2018",
address = "United States",
}