2026-09-20T15:45:36Z https://www.ideals.illinois.edu/oai-pmh

oai:www.ideals.illinois.edu:2142/100897 2023-07-11 col_2142_5131 col_2142_8888 com_2142_5130 com_2142_8887 com_2142_234

Tracking certificate misissuance in the wild text text Bailey, Michael D Wang, Zhengping 2018-09-04T20:26:32Z 2018-09-04T20:26:32Z 2018-02-01 2018-05 Certificate Authorities (CAs) are responsible for delegating trust in the TLS Public Key Infrastructure (PKI). Unfortunately, there is a long history of CAs abusing this responsibility, either due to negligence or in some cases, falling victim to attacks. As a result, the PKI community has established standards that define the correctness of certificates and how a well managed CA should operate. In this work, we evaluate a systematic approach to identifying whether certificates issued by CAs are compliant with community standards. To this end, we present ZLint, a system that determines whether a certificate is not conformant to standards, i.e., misissued. We find that while misissuance has decreased over time, there is still a long tail of non-conformant CAs in the ecosystem. Further, our results show that certificate misissuance serves as a reasonable indicator for mismanagement and untrustworthiness, suggesting that CAs that misissue more frequently pose a greater threat to security of the PKI. Community efforts thus far to curb these threats have been moderately successful, but the lack of a systematic approach to identifying these problems lets some classes of problems slip through the cracks. We argue that an automated and systematic approach to measuring misissuance in the ecosystem is a necessary first step in solving the problems that lie ahead. Submission original under an indefinite embargo labeled 'Open Access'. The submission was exported from vireo on 2018-08-31 without embargo terms The student, Zhengping Wang, accepted the attached license on 2018-02-01 at 09:41. The student, Zhengping Wang, submitted this Thesis for approval on 2018-02-01 at 09:53. This Thesis was approved for publication on 2018-02-01 at 14:04. DSpace SAF Submission Ingestion Package generated from Vireo submission #12030 on 2018-08-31 at 17:08:15 Made available in DSpace on 2018-09-04T20:26:32Z (GMT). No. of bitstreams: 2 WANG-THESIS-2018.pdf: 440123 bytes, checksum: 7cb1b3735d3ed38c245c0442a5bedd10 (MD5) LICENSE.txt: 4211 bytes, checksum: c5c7db273405fbecd4c6d8dbf9295bc1 (MD5) Previous issue date: 2018-02-01 application/pdf http://hdl.handle.net/2142/100897 en Copyright 2018 Zhengping Wang Certificate Misissuance Electrical & Computer Eng Electrical & Computer Engr University of Illinois at Urbana-Champaign Thesis M.S.