CoChat
Sign Up
PreprintCited by 14Web Application Security VulnerabilitiesPrivacy, Security, and Data ProtectionCybersecurity and Information Systems

Shedding Light on the Adoption of Let's Encrypt

Open access
Manousis, Antonis, Ragsdale, Roy, Draffin, Ben, Agrawal, Adwiteeya, Sekar, Vyas·2016·arXiv
DOI 10.48550/arxiv.1611.00469arXiv 1611.00469
Open this paper in CoChat — free accountOpen PDF

Abstract

Let's Encrypt is a new entrant in the Certificate Authority ecosystem that offers free and automated certificate signing. It is visionary in its commitment to Certificate Transparency. In this paper, we shed light on the adoption patterns of Let's Encrypt "in the wild" and inform the future design and deployment of this exciting development in the security landscape. We analyze acquisition patterns of certificates as well as their usage and deployment trends in the real world. To this end, we analyze data from Certificate Transparency Logs containing records of more then 18 million certificates. We also leverage other sources like Censys, Alexa's historic records, Geolocation databases, and VirusTotal. We also perform active HTTPS measurements on the domains owning Let's Encrypt certificates. Our analysis of certificate acquisition shows that (1) the impact of Let's Encrypt is particularly visible in Western Europe; (2) Let's Encrypt has the potential to democratize HTTPS adoption in countries that are recent entrants to Internet adoption; (3) there is anecdotal evidence of popular domains quitting their previously untrustworthy or expensive CAs in order to transition to Let's Encrypt; and (4) there is a "heavy tailed" behavior where a small number of domains acquire a large number of certificates. With respect to usage, we find that: (1) only 54% of domains actually use the Let's Encrypt certificates they have procured; (2) there are many non-trivial incidents of server misconfigurations; and (3) there is early evidence of use of Let's Encrypt certificates for typosquatting and for malware-laden sites.

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Integrity signals

Registry

DataCite · 10.48550/arxiv.1611.00469

Cites

1 of 1 references verified0 citation errors · 0 not checkable

Statistics

Claims the paper makes

The claims and statistics of this paper haven’t been checked yet.

Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.

A few free checks a day · papers already verified open instantly · results are public

Claims other papers make about this one

Each is checked against this paper’s own text: does it say what the citing paper says it does?

  • In their Common Crawl method, [32] found that Let's Encrypt was used in 24% of the sites found, with Comodo at 21%.

    “In their Common Crawl method, they found that Let's Encrypt was used in 24% of the sites found, with Comodo at 21%.”

    From Analysis of the adoption of security headers in HTTP (2018) · cites this paper as [32]

    The Sources of Data section (p. 4) says the authors collected domains from Certificate Transparency logs, not Common Crawl. The paper does not report the claimed 24% and 21% shares; its Comodo figure in Table V (p. 8) measures the share of domains transitioning from that CA to Let's Encrypt, not Comodo's share of sites found. (LLM, conf=0.83)

    Checked by a reasoning model — may be wrong.

    Experimental — accuracy not yet measured

  • Reference [32] scanned the Alexa sites from 29 July to 29 August 2016 and found 8% of the million sites containing Let's Encrypt sites, compared with 30% for Comodo and 17% for GeoTrust.

    “Reference [32] scanned the Alexa sites from 29 July to 29 August 2016, and found 8% of the million sites containing Let's Encrypt sites, compared with 30% for Comodo and 17% for GeoTrust.”

    From Analysis of the adoption of security headers in HTTP (2018) · cites this paper as [32]

    The paper’s “Adoption by popular domains” section (p. 8) analyzes Let’s Encrypt use among Alexa’s top one million domains, supporting that part of the attribution. Our copy does not report a 29 July–29 August 2016 scan or the claimed 8%, 30%, and 17% shares. The 31.21% Comodo figure in Table V (p. 8) instead concerns domains that transitioned from Comodo to Let’s Encrypt, not Comodo’s share of the million sites. (LLM, conf=0.88)

    Experimental — accuracy not yet measured

  • [32] found that 1.2% of the Alexa top million for May 2017 have transitioned from paid CAs to Let's Encrypt.

    “They found that 1.2% of the Alexa top million, for May 2017, have transitioned from paid CAs to Let's Encrypt”

    From Analysis of the adoption of security headers in HTTP (2018) · cites this paper as [32]

    The Introduction (p. 2) reports that 1.2% of popular websites in the Alexa top million transitioned from paid CAs to Let's Encrypt. The claim's May 2017 date is not supported: the Rate of Adoption section (p. 5) says the data were collected only through 15 May 2016. (LLM, conf=0.90)

    Experimental — accuracy not yet measured

  • The results tally with [32], but also contribute to the trend of the general increase in adoption as we move down the ranking, which ends up between 4.5 and 5.8%.

    “The results tally with [32], but also contribute in the trend of the general increase in adoption as we move down the ranking, which ends up between 4.5 and 5.8%.”

    From Analysis of the adoption of security headers in HTTP (2018) · cites this paper as [32]

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

The self-check needs the paper’s full text.

Cites

Flagged first, then by citations

Research works printed but not linked: 18

  1. [33][33] D. Akhawe, B. Amann, M. Vallentin, and R. Sommer. Here's my cert, so trust me, maybe?: Understanding tls errors on the web. In Proceedings of the 22Nd International Conference on World Wide Web , WWW '13, pages 59-70, New York, NY, USA, 2013. ACM. -
  2. [32][32] P. Agten, W. Joosen, F. Piessens, and N. Nikiforakis. Seven months' worth of mistakes: A longitudinal study of typosquatting abuse. In Proceedings of the 22nd Network and Distributed System Security Symposium (NDSS 2015) . Internet Society, February 2015. -
  3. [34][34] A. Bates, J. Pletcher, T. Nichols, B. Hollembaek, and K. R. B. Butler. Forced Perspective: Evaluating an SSL Trust Enhancement at Scale. In Proc. IMC , 2014. -
  4. [35][35] L. Chuat, P. Szalachowski, A. Perrig, B. Laurie, and E. Messeri. Efficient gossip protocols for verifying the consistency of certificate logs. In Communications and Network Security (CNS), 2015 IEEE Conference on , pages 415-423, Sept 2015. -
  5. [37][37] Z. Durumeric, D. Adrian, A. Mirian, M. Bailey, and J. A. Halderman. A Search Engine Backed by Internet-Wide Scanning. In Proc. CCS , 2015. -
  6. [38][38] Z. Durumeric, M. Bailey, and J. A. Halderman. An Internet-Wide View of Internet-Wide Scanning. In Proc. USENIX Security , 2014. -
  7. [40][40] Z. Durumeric, J. Kasten, M. Bailey, and J. A. Halderman. Analysis of the https certificate ecosystem. In Proceedings of the 2013 Conference on Internet Measurement Conference , IMC '13, pages 291-304, New York, NY, USA, 2013. ACM. -
  8. [39][39] Z. Durumeric, J. Kasten, D. Adrian, J. A. Halderman, M. Bailey, F. Li, N. Weaver, J. Amann, J. Beekman, M. Payer, and V. Paxson. The Matter of Heartbleed. In Proc. IMC 14 , 2014. -
  9. [41][41] L. S. Huang, A. Rice, E. Ellingsen, and C. Jackson. Analyzing forged ssl certificates in the wild. In Security and Privacy (SP), 2014 IEEE Symposium on , pages 83-97, May 2014. -
  10. [43][43] B. Laurie. Certificate transparency. Queue , 12(8):10:10-10:19, Aug. 2014. -
  11. [42][42] M. T. Khan, X. Huo, Z. Li, and C. Kanich. Every second counts: Quantifying the negative externalities of cybercrime via typosquatting. In 2015 IEEE Symposium on Security and Privacy , pages 135-150, May 2015. -
  12. [44][44] C. Lever, R. Walls, Y. Nadji, D. Dagon, P. McDaniel, and M. Antonakakis. Domain-Z: 28 Registrations Later Measuring the Exploitation of Residual Trust in Domains. In Proc. IEEE S&P , 2016. -
  13. [46][46] D. Naylor, A. Finamore, I. Leontiadis, Y. Grunenberger, M. Mellia, M. Munafo, K. Papagiannaki, and P. Steenkiste. The Cost of the 'S' in HTTPS. In Proc. Conext , 2014. -
  14. [45][45] Y. Liu, W. Tome, L. Zhang, D. Choffnes, D. Levin, B. Maggs, A. Mislove, A. Schulman, and C. Wilson. An End-to-End Measurement of Certificate Revocation in the Webs PKI. In Proc. IMC 15 , 2015. -
  15. [47][47] M. D. Ryan. Enhanced certificate transparency and end-to-end encrypted mail. In NDSS , 2014. -
  16. [49][49] D. Wendlandt, D. G. Andersen, and A. Perrig. Perspectives: Improving SSH-style Host Authentication with Multi-Path Probing. In Proc. USENIX ATC , 2008. -
  17. [48][48] M. Varvello, K. Schomp, D. Naylor, J. Blackburn, A. Finamore, and K. Papagiannaki. Is The Web HTTP/2 Yet? . In Proc. PAM , 2016. -
  18. [50][50] L. Zhang, D. Choffnes, D. Levin, T. Dumitras, A. Mislove, A. Schulman, and C. Wilson. Analysis of SSL Certificate Reissues and Revocations in the Wake of Heartbleed. In Proc. IMC 14 , 2014.

Cited by

Sorted by citations

Authors
Manousis, A., Ragsdale, R., Draffin, B., Agrawal, A., & Sekar, V.
ORCID
Venue
arXiv
Publisher
arXiv
Published
2016
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.1611.00469
arXiv
1611.00469
OpenAlex
W2548938560
Cited by
14
References
1
Citations by year
2021: 2 · 2020: 3 · 2019: 3 · 2018: 5 · 2017: 1
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Topics
  • Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
  • Social Sciences › Sociology and Political Science › Privacy, Security, and Data Protection
  • Physical Sciences › Computer Science › Computer Networks and Communications › Cybersecurity and Information Systems
Keywords
Let's Encrypt, certificate authority, certificate transparency, typosquatting, heavy-tailed distributions, internet adoption

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review