Understanding TLS certificate validation errors
summary
Research runs a booth study with 75 developers who inspect five TLS certificate failures using OpenSSL and other TLS tools; half see original errors, half see rewritten text plus a short doc site. The team builds a one‑page explanation site and links from errors; about three quarters click the link and some users perform extra checks, trust ratings shift (self‑signed shows ~45% total distrust), yet permitted subtree violation remains widely misunderstood.
AI-written summary · about
chapters (17)
- 0:00Understanding TLS certs validation errors
- 2:55Usability of PGP 5.0 (1999)
- 6:08Solution 2
- 7:23Problem statement How do people in IT perceive certificate flaws?
- 11:14Participant stats 75 participants (8)
- 13:22OK (Github)
- 16:32Expired (Microsoft)
- 19:34Self-signed (Fedora project)
- 22:09Hostname mismatch (Facebook)
- 24:23Name constraints (Google)
- 28:09Trust scale (0-6)
- 28:53Trust comparison by case
- 30:39Trust in expired certificates (average)
- 31:33Idea: Test different designs
- 33:53Caused perception differences OK
- 34:49Caused trust differences
- 38:15What can I do next?
related talks
23mMaking heads or tails of TLS certificate errors
25mUntangling the certificate error messages
27mDebugging TLS/SSL
40mWebsite security 101
44mSSL/TLS for Mortals
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
46mMastering TLS, OpenSSL and Certificates
59mProactively defending your business