Trust Unearned? Evaluating CA Trustworthiness Across 5 Billion Certificates
summary
Analysis downloads and indexes 5 billion TLS certificates from CT logs into Splunk, matches them against 185 million IOCs, and groups results by 78,000 issuing CAs and 497 root CAs. Risk uses a Z‑score outlier method on CA-level malicious certificate percentages, yielding about ten risky root outliers and several risky issuers (GoDaddy, ZeroSSL, Trust Ocean) while highlighting sampling artifacts like ISRG/Let’s Encrypt appearing risky due to tiny sample counts. Synthesized results are published synthesized data on GitHub.
AI-written summary · about
chapters (13)
- 0:00Introduction and disclaimer
- 1:02Project origin and team
- 3:52PKI concepts overview
- 7:02Certificate data collection
- 10:58Threat intelligence sources
- 14:05Big data challenges
- 16:30Risk assessment methodology
- 18:59Root CA risk analysis
- 21:05Issuer risk analysis
- 24:17Risky and trusty outliers
- 27:06Conclusions and future work
- 29:33Call to action and resources
- 31:16Q&A session
related talks
30mTrust Engineering: Building Security Leadership at Early-Stage...
51mCertificate Transparency Logs: Roadmaps to Riches or Ruin?
51mUnderstanding TLS certificate validation errors
16mPKI problem: who we actually trust
20mTrust Agility in an Era of Transient Ties: Rethinking TLS...
44mA Matter Of Trust: When Security Is Not Enough
23mMaking heads or tails of TLS certificate errors
30mHashiTLS: Demystifying Security Certs