Certificate Validation and Domain Impersonation
Corrado Vecchio
Certificate Validation and Domain Impersonation.
Rel. Antonio Lioy, Diana Gratiela Berbecaru. Politecnico di Torino, Corso di laurea magistrale in Ingegneria Informatica (Computer Engineering), 2021
|
Preview |
PDF (Tesi_di_laurea)
- Tesi
Licenza: Creative Commons Attribution Non-commercial No Derivatives. Download (6MB) | Preview |
Abstract
Security of the World Wide Web ecosystem depends on the ability of web browsers of detecting revoked certificates. TLS protocol ensures a secure connection between two entities, but it could not be enough in case browsers accept connection with web server hosting revoked certificates. In this work, I firstly analyse a X.509 certificate dataset corresponding to the Alexa Top 1M Sites. I find that more than 55% of certificate belonging to the data set has been issued by Let’s Encrypt and 4054 end-entity certificates does not provide a way for checking their revocation status. I also study the behaviour of 6 different web browsers on handling revocation information under different situations and operating systems.
I surprisingly find out that browsers apply always a soft fail approach when revocation information are not available and some of them check revocation status of the entire certificates appearing in the chain only in presence of EV-certificates
Relatori
Tipo di pubblicazione
URI
![]() |
Modifica (riservato agli operatori) |
