Do CAA, CT, and DANE Interlink in Certificate Deployments? A Web PKI Measurement Study
Fuente:
arXiv
Guardado en:
| Autores principales: | , , , , |
|---|---|
| Formato: | Preprint |
| Publicado: |
2024
|
| Materias: | |
| Acceso en línea: | |
| Etiquetas: |
Agregar Etiqueta
Sin Etiquetas, Sea el primero en etiquetar este registro!
|
| _version_ | 1866917710458257408 |
|---|---|
| author | Tehrani, Pouyan Fotouhi Hiesgen, Raphael Lübeck, Teresa Schmidt, Thomas C. Wählisch, Matthias |
| author_facet | Tehrani, Pouyan Fotouhi Hiesgen, Raphael Lübeck, Teresa Schmidt, Thomas C. Wählisch, Matthias |
| contents | Integrity and trust on the web build on X.509 certificates. Misuse or misissuance of these certificates threaten the Web PKI security model, which led to the development of several guarding techniques. In this paper, we study the DNS/DNSSEC records CAA and TLSA as well as CT logs from the perspective of the certificates in use. Our measurements comprise 4 million popular domains, for which we explore the existence and consistency of the different extensions. Our findings indicate that CAA is almost exclusively deployed in the absence of DNSSEC, while DNSSEC protected service names tend to not use the DNS for guarding certificates. Even though mainly deployed in a formally correct way, CAA CA-strings tend to not selectively separate CAs, and numerous domains hold certificates beyond the CAA semantic. TLSA records are repeatedly poorly maintained and occasionally occur without DNSSEC. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2407_02287 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | Do CAA, CT, and DANE Interlink in Certificate Deployments? A Web PKI Measurement Study Tehrani, Pouyan Fotouhi Hiesgen, Raphael Lübeck, Teresa Schmidt, Thomas C. Wählisch, Matthias Cryptography and Security Networking and Internet Architecture Integrity and trust on the web build on X.509 certificates. Misuse or misissuance of these certificates threaten the Web PKI security model, which led to the development of several guarding techniques. In this paper, we study the DNS/DNSSEC records CAA and TLSA as well as CT logs from the perspective of the certificates in use. Our measurements comprise 4 million popular domains, for which we explore the existence and consistency of the different extensions. Our findings indicate that CAA is almost exclusively deployed in the absence of DNSSEC, while DNSSEC protected service names tend to not use the DNS for guarding certificates. Even though mainly deployed in a formally correct way, CAA CA-strings tend to not selectively separate CAs, and numerous domains hold certificates beyond the CAA semantic. TLSA records are repeatedly poorly maintained and occasionally occur without DNSSEC. |
| title | Do CAA, CT, and DANE Interlink in Certificate Deployments? A Web PKI Measurement Study |
| topic | Cryptography and Security Networking and Internet Architecture |
| url | https://arxiv.org/abs/2407.02287 |