Tracking Certificate Misissuance in the Wild

Certificate Authorities (CAs) are responsible for delegating trust in the TLS Public Key Infrastructure (PKI). Unfortunately, there is a long history of CAs abusing this responsibility, either due to negligence [23], [24], [33] or in some cases, falling victim to attacks [16]. As a result, the PKI community has established standards that define the correctness of certificates and how a well managed CA should operate [1]. In this work, we evaluate a systematic approach to identifying whether certificates issued by CAs are compliant with community standards. To this end, we present Jupiter, a system that determines whether a certificate is not conformant to standards, i.e., misissued. We find that while misissuance has decreased over time, there is still a long tail of non-conformant CAs in the ecosystem. Further, our results show that certificate misissuance serves as a reasonable indicator for mismanagement and untrustworthiness, suggesting that CAs that misissue more frequently pose a greater threat to security of the PKI. Community efforts thus far to curb these threats have been moderately successful, but the lack of a systematic approach to identifying these problems lets some classes of problems slip through the cracks. We argue that an automated and systematic approach to measuring misissuance in the ecosystem is a necessary first step in solving the problems that lie ahead. I . I N T R O D U C T I O N In the last year alone, there have been a number of highprofile cases where Certificate Authorities (CAs) were caught misbehaving. For example, in September 2016, WoSign, a popular Chinese CA, and their subsidiary, StartCom, were found backdating SHA-1 certificates to avoid updating their systems to deprecate SHA-1. This was an explicit violation of community standards. As a result, both Mozilla and Google have begun the process to distrust WoSign and StartCom certificates in both Firefox and Chrome [25], [33]. WoSign is a just recent example of a historically reoccurring problem [16], [23], [24]. In light of these failures, the PKI community responded by leading a number of efforts designed to improve the transparency, security, and reliability of the ecosystem. One effort, the CA/Browser Forum Baseline Requirements (BRs), dictate a set of rules that specify the correctness of certificates and how a well managed CA should operate [1]. Deviations from these standards are not necessarily direct vulnerabilities; however, the community views conformance as a necessary precondition for establishing a secure and reliable PKI [29]. In addition, certain classes of violations do directly lead to vulnerabilities, further increasing the importance of imposing such standards on the ecosystem. Another effort, Certificate Transparency (CT), aims to reduce the opacity of the ecosystem by requiring that trusted CAs submit every certificate they issue to a public ledger. By April 2018, certificates that are not in at least two CT logs will be untrusted by Google Chrome [28]. Despite the successful efforts to establish standards and enable transparency in the CA ecosystem, the community failed to build tools that systematically analyze the data collected. As a result, there is a large effort to utilize the Mozilla Dev Security Policy (MDSP) [2] forum as a means for discussion around misbehaving CAs. Unfortunately, reporting and investigation is done in an ad-hoc fashion, and misissued certificates, which are certificates that do not conform to the BRs, are often found by chance, indicating a need for a systematic approach to identify misbehavior. In this work, we present and deploy Jupiter, a system that determines if a certificate is compliant with community standards. Jupiter now runs as a part of Censys [14] and crt.sh [30], two popular tools used by the PKI community to track certificates. We leverage a corpus of 240M certificates collected through Internet-wide scans and CT logs, active probing of CA infrastructure, and web crawls of MDSP forum posts, to inform a holistic analysis of the ecosystem today. We track certificate misissuance longitudinally and find that in 2017, only 0.02% of trusted certificates are misissued. This has fallen from 8.4% since the BRs took effect in 2013, and indicates that that ecosystem is certainly improving over time. Still, we find 140K currently trusted certificates are misissued today, and 60% of trusted intermediates on the Internet misissue at least 10% of their certificates. MDSP discussions catch some of these problems, however, we observe discussion is skewed towards larger players and mostly focused on misissuance, rather than all aspects of CA operation. We next turn to studying misissuance today. We use two metrics—misissuance by raw number of certificates and misissuance by fraction of total certificates issued, to track problematic organizations in the ecosystem. We use recent incidents of CAs losing browser trust (Symantec, WoSign, StartCom, PROCERT) [21], [25], [26] as a guide, and identify two distinct equivalence classes of organizations: ones that have 10,000 or more misissued currently valid certificates, and ones that misissue 90% or more of their total certificates. We find one other instance of the first class (GoDaddy) and 38 other instances of the second, pointing to organizations that should be subject to further scrutiny. Finally, we investigate how certificate misissuance occurs. We find that most large organizations are in charge of several intermediate CAs, with an average of 20 intermediates below an organization. In 80% of the cases where such an organization misissues a certificate, we can trace the majority of misissuance to a single intermediate within that organization, indicating Permission to freely reproduce all or part of this paper for noncommercial purposes is granted provided that copies bear this notice and the full citation on the first page. Reproduction for commercial purposes is strictly prohibited without the prior written consent of the Internet Society, the first-named author (for reproduction of an entire paper only), and the author’s employer if the paper was prepared within the scope of employment. to us multiple, disparate systems that issue certificates. We argue this adds complexity to the issuance process, and further, makes oversight over an organization complicated, which can lead to further problems. We conclude with a discussion of the effectiveness of our measurements and propose areas for future work. We hope the results presented in this work serve as a call to action to utilize a systematic approach to analyzing the CA ecosystem moving forward, and that our work will aid in improving the PKI at large. I I . B A C K G R O U N D In this section, we provide a brief background on TLS, Certificates, and the terminology used throughout the paper.