Patent ID: 9479338
Filing Date: 2016-10-25
CPC Classification: G06F,H04L

Claim Text:
1. A method for determining trustworthiness of a certificate authority, comprising: obtaining a security score for the certificate authority, comprising; obtaining certificate resource information from one or more networks; analyzing the certificate resource information; assigning a security score to the certificate authority based at least in part on the analysis of the certificate resource information; and relying, based on the security score, on a certificate issued by the certificate authority, comprising at least two of: determining to trust the certificate, based on the security score, for a set of some but not all websites; determining to trust the certificate, based on the security score, if a second certificate from a second certificate authority corroborates the certificate; and determining to trust the certificate, based on the security score, if no certificates from higher-ranked certificate authorities are available; wherein analyzing the certificate resource information comprises determining, for at least one certificate in the certificate resource information, at least two of: that a domain from which the at least one certificate was received is a phishing attempt; that the certificate has internal names in the certificate's subject alternative name field; that the issuing certificate authority has received bad press.