Risky Business

Secure communication on the Internet is built around the trust of digital certificates. Web servers present a digital certificate to browsers as authentication much like people present an official picture ID as proof of identity. Digital certificates have an expiration date, however, prior to expiration there are multiple reasons why a certificate may no longer be valid. The Internet's Public Key Infrastructure provides methods for browsers to check the validity of digital certificates but are all browsers configured to perform these checks? The recent Heartbleed vulnerability resulted in thousands of revoked certificates from vulnerable servers that should no longer be trusted. This paper takes a closer look at how digital certificates are revoked and how effectively our browsers use revocation information. It will also examine some of the newer techniques used to detect revocation status like OCSP stapling, OCSP mustS staple, OCSP multiSstaple and CRLSets.