Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

How to Measure TLS, X.509 Certificates, and Web PKI: A Tutorial and Brief Survey

Pouyan Fotouhi Tehrani, Eric Osterweil, Thomas C. Schmidt, Matthias Wählisch

TL;DR

This paper presents a structured approach to measuring TLS deployments, X.509 certificates, and Web PKI by surveying prior work, proposing a cohesive measurement framework, and validating it with three independent datasets. It emphasizes a taxonomy of measurement aspects (TLS and Web PKI), longitudinal versus snapshot frequency, and passive versus active data collection, while detailing data sources, tooling, and best practices. The authors highlight common causes of divergence in measurement results, such as differing setups and data sources, and provide guidance to minimize such inconsistencies, including temporal integrity, reproducibility, and robust data interpretation. The practical impact is a set of concrete recommendations and a reproducible workflow for researchers and operators to assess TLS/Web PKI deployments, CA practices, DNS interactions, and user-facing security properties.

Abstract

Transport Layer Security (TLS) is the base for many Internet applications and services to achieve end-to-end security. In this paper, we provide guidance on how to measure TLS deployments, including X.509 certificates and Web PKI. We introduce common data sources and tools, and systematically describe necessary steps to conduct sound measurements and data analysis. By surveying prior TLS measurement studies we find that diverging results are rather rooted in different setups instead of different deployments. To improve the situation, we identify common pitfalls and introduce a framework to describe TLS and Web PKI measurements. Where necessary, our insights are bolstered by a data-driven approach, in which we complement arguments by additional measurements.

How to Measure TLS, X.509 Certificates, and Web PKI: A Tutorial and Brief Survey

TL;DR

This paper presents a structured approach to measuring TLS deployments, X.509 certificates, and Web PKI by surveying prior work, proposing a cohesive measurement framework, and validating it with three independent datasets. It emphasizes a taxonomy of measurement aspects (TLS and Web PKI), longitudinal versus snapshot frequency, and passive versus active data collection, while detailing data sources, tooling, and best practices. The authors highlight common causes of divergence in measurement results, such as differing setups and data sources, and provide guidance to minimize such inconsistencies, including temporal integrity, reproducibility, and robust data interpretation. The practical impact is a set of concrete recommendations and a reproducible workflow for researchers and operators to assess TLS/Web PKI deployments, CA practices, DNS interactions, and user-facing security properties.

Abstract

Transport Layer Security (TLS) is the base for many Internet applications and services to achieve end-to-end security. In this paper, we provide guidance on how to measure TLS deployments, including X.509 certificates and Web PKI. We introduce common data sources and tools, and systematically describe necessary steps to conduct sound measurements and data analysis. By surveying prior TLS measurement studies we find that diverging results are rather rooted in different setups instead of different deployments. To improve the situation, we identify common pitfalls and introduce a framework to describe TLS and Web PKI measurements. Where necessary, our insights are bolstered by a data-driven approach, in which we complement arguments by additional measurements.
Paper Structure (92 sections, 11 figures, 6 tables)

This paper contains 92 sections, 11 figures, 6 tables.

Table of Contents

  1. Introduction
  2. Background
  3. Transport Layer Security
  4. Components
  5. Handshake
  6. Extensions
  7. Web PKI and X.509
  8. Technical basis and governing entities
  9. Usage and semantics
  10. DNS and DNSSEC
  11. Removing ambiguity between CA and public keys
  12. Authorizing certifcate issuance
  13. Upgrading opportunistic TLS
  14. Principles for a TLS Measurement Framework
  15. Measurement Aspects and Features
  16. ...and 77 more sections

Figures (11)

  • Figure 1: Stages of TLS and Web PKI measurement alongside selected aspects as discussed in this paper
  • Figure 2: An overview of involved parties and components in TLS and Web PKI ecosystems
  • Figure 3: TLS Components: Handshake, Alert, and Record Protocols
  • Figure 4: Technical and political aspects shaping X.509 Certificates in Web PKI
  • Figure 5: A taxonomy for TLS and Web PKI measurement with selected examples (in gray)
  • ...and 6 more figures