Towards a Complete View of the Certificate Ecosystem
Open accessAbstract
The HTTPS certificate ecosystem has been of great interest to the measurement and security communities. Without any ground truth, researchers have attempted to study this PKI from a variety of fragmented perspectives, including passively monitored networks, scans of the popular domains or the IPv4 address space, search engines such as Censys, and Certificate Transparency (CT) logs. In this work, we comparatively analyze all these perspectives. We find that aggregated CT logs and Censys snapshots have many properties that complement each other, and that together they encompass over 99% of all certificates found by any of these techniques. However, they still miss 1.5% of certificates observed in a crawl of all domains in .com, .net, and .org. We go on to illustrate how this combined perspective affects results from previous studies. In light of these findings, we have worked with the operators of Censys to incorporate CT log data into its results going forward, and we recommend that future HTTPS measurement adopt this new vantage.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Durumeric, Z., Li, F., Kasten, J., Amann, J., Beekman, J. G., Payer, M., Weaver, N., Adrian, D., Paxson, V., Bailey, M., et al. (2014) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2663716.2663755 · Cited by 692 · see citing works
Self-citationZMap: fast internet-wide scanning and its security applications
Durumeric, Z., Wustrow, E., & Halderman, J. A. (2013) · Cited by 570 · see citing works
Self-citationA Search Engine Backed by Internet-Wide Scanning
Durumeric, Z., Adrian, D., Mirian, A., Bailey, M., & Halderman, J. A. (2015) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/2810103.2813703 · Cited by 447 · see citing works
Self-citationLaurie, B., Langley, A., & Kasper, E. (2013) · doi:10.17487/rfc6962 · Cited by 378 · see citing works
Mining Your Ps and Qs: Detection of Widespread Weak Keys in Network Devices
Heninger, N., Durumeric, Z., Wustrow, E., & Halderman, J. A. (2013) · Cited by 346 · see citing works
Self-citationAnalysis of the HTTPS certificate ecosystem
Durumeric, Z., Kasten, J., Bailey, M., & Halderman, J. A. (2013) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2504730.2504755 · Cited by 294 · see citing works
Self-citationA Messy State of the Union: Taming the Composite State Machines of TLS
Beurdouche, B., Bhargavan, K., Delignat-Lavaud, A., Cédric Fournet, A., Kohlweiss, M., Pironti, A., Strub, P.-Y., & Zinzindohoué, J. K. (2015) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2015.39 · Cited by 221 · see citing works
Holz, R., Braun, L., Kammenhuber, N., & Carle, G. (2011) · ACM Internet Measurement Conference (IMC) · doi:10.1145/2068816.2068856 · Cited by 192 · see citing works
Transport Layer Security (TLS) Extensions: Extension Definitions
Eastlake, D. (2011) · doi:10.17487/rfc6066 · Cited by 188 · see citing works
Neither Snow Nor Rain Nor MITM...
Durumeric, Z., Adrian, D., Mirian, A., et al. (2015) · Internet Measurement Conference · doi:10.1145/2815675.2815695 · Cited by 117 · see citing works
Self-citationHere's my cert, so trust me, maybe?
Akhawe, D., Amann, J., Vallentin, M., et al. (2013) · International World Wide Web Conference (WWW) · doi:10.1145/2488388.2488395 · Cited by 82 · see citing works
Self-citationAnalysis of SSL certificate reissues and revocations in the wake of heartbleed
Zhang, L., Choffnes, D., Levin, D., et al. (2014) · doi:10.1145/2663716.2663758 · Cited by 80 · see citing works
Lenstra, A. K., Hughes, J. P., Augier, M., Bos, J. W., Kleinjung, T., & Wachter, C. (2012) · Lecture notes in computer science · doi:10.1007/978-3-642-32009-5_37 · Cited by 79 · see citing works
The Inconvenient Truth About Web Certificates
Vratonjić, N., Freudiger, J., Bindschaedler, V., & Hubaux, J. (2012) · Springer eBooks · doi:10.1007/978-1-4614-1981-5_5 · Cited by 70 · see citing works
Amann, J., Sommer, R., Vallentin, M., & Hall, S. (2013) · Annual Computer Security Applications Conference · doi:10.1145/2523649.2523665 · Cited by 37 · see citing works
Self-citationAn Experimental Study of TLS Forward Secrecy Deployments
Huang, L.-S., Adhikarla, S., Boneh, D., et al. (2014) · IEEE Internet Computing · doi:10.1109/mic.2014.86 · Cited by 35 · see citing works
Vallina-Rodríguez, N., Amann, J., Kreibich, C., et al. (2014) · doi:10.1145/2674005.2675015 · Cited by 32 · see citing works
Self-citationИнформатика (2010) · Betascript Publishing eBooks · Cited by 27 · see citing works
On the Detection of Fake Certificates via Attribute Correlation
Gu, X., & Gu, X. (2015) · Entropy · doi:10.3390/e17063806 · Cited by 14 · see citing works
Harvesting SSL Certificate Data to Mitigate Web-FraudPreprint
Mishari, M. A., Cristofaro, E. D., Defrawy, K. M. E., et al. (2009) · arXiv (Cornell University) · Cited by 6 · see citing works
Harvesting SSL Certificate Data to Identify Web-FraudPreprint
Mishari, M. A., Cristofaro, E. D., Defrawy, K. E., et al. (2009) · arXiv (Cornell University) · doi:10.48550/arxiv.0909.3688 · Cited by 3 · see citing works
Flagged first, then by citations
Research works printed but not linked: 2
- [17]17. R. Holz, J. Amann, O. Mehani, M. Wachs, and M. A. Kaafar. TLS in the wild: An Internet-wide analysis of TLS-based protocols for electronic communication. In S. Capkun, editor, Network and Distributed System Security Symposium, Feb. 2016.
- [22]22. A. K. Lenstra, J. P. Hughes, M. Augier, J. W. Bos, T. Kleinjung, and C. Wachter. Public keys. In 32nd International Cryptology Conference, Aug. 2012.
Cited by
Sorted by citations
Analysis of the adoption of security headers in HTTP
Buchanan, W. J., Helme, S., & Woodward, A. (2018) · IET Information Security · doi:10.1049/iet-ifs.2016.0621 · Cited by 38 · see citing works
“RFC 7034 added HTTP header field XFO [13], which protects web applications against clickjacking, and within the integration of content from other web pages.”
BackgroundMethod
- Authors
- VanderSloot, B., Amann, J., Bernhard, M., Durumeric, Z., Bailey, M., & Halderman, J. A.
- Affiliations
- University of Michigan (US)
- International Computer Science Institute (US)
- University of Illinois Urbana-Champaign (US)
- Venue
- Proceedings of the 2016 Internet Measurement Conference
- Publisher
- ACM
- Published
- 2016-11-14
- Pages
- 543-549
- OpenAlex
- W2552873532
- Cited by
- 82
- References
- 21
- Citations by year
- 2026: 2 · 2025: 4 · 2024: 5 · 2023: 9 · 2022: 6 · 2021: 14 · 2020: 12 · 2019: 12 · 2018: 9 · 2017: 8 · 2016: 1
- FWCI
- 8.49
- Type
- conference paper
- Language
- en
- Open access
- bronze
- doi.org
- Locations
- ACM Internet Measurement Conference (IMC) (publishedVersion)
- Funders
- Google Ph.D. Fellowship in Computer Security
- National Science Foundation (ACI-1348077, CNS-1518888, CNS- 1409505, CNS- 1530915, CNS-1505790, CNS-1518741, CNS-1528156, CNS-1345254)
- Alfred P. Sloan Foundation Research Fellowship
- Topics
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Artificial Intelligence › Internet Traffic Analysis and Secure E-voting
- Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
- Keywords
- public key infrastructure, certificate transparency logs
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
