Web PKI: Closing the Gap between Guidelines and Practices

International audienceA string of recent attacks against the global publickey infrastructure (PKI) has brought to light weaknesses in thecertification authority (CA) system. In response, the CA/BrowserForum, a consortium of certification authorities and browservendors, published in 2011 a set of requirements applicable to allcertificates intended for use on the Web and issued after July 1st,2012, following the successful adoption of the extended validationguidelines in 2007. We evaluate the actual level of adherence tothe CA/Browser Forum guidelines over time, as well as the impactof each violation, by inspecting a large collection of certificatesgathered from Web crawls. We further refine our analysis byautomatically deriving profile templates that characterize themakeup of certificates per issuer. By integrating these templateswith violation statistics, we are able to depict the practices ofcertification authorities worldwide, and thus to monitor the PKIand proactively detect major violations. Our method also providesnew means of assessing the trustworthiness of SSL certificatesused on the Web