PKI & Certificates

187 posts

Long-form

The Post-Quantum WebPKI50 min readPKI & Certificates Cryptography & Keys
How the Internet will decide which public keys to trust once signatures no longer fit on the wire.
A Deep Dive on the Classical WebPKI90 min readPKI & Certificates
How the Internet decides which public keys to trust.

Posts

From Chains to TreesAugust 4, 20261 min readPKI & Certificates
A CA That Produces Evidence, Not PromisesMay 23, 202619 min readPKI & Certificates Compliance & Audits
A CA Built for the Threat Model We Actually HaveMay 23, 202610 min readPKI & Certificates Compliance & Audits
The WebPKI and Client Authentication Are at a CrossroadsMarch 21, 202610 min readPKI & Certificates Identity & Authentication
Introducing the WebPKI ObservatoryMarch 15, 20264 min readPKI & Certificates Compliance & Audits
When Compliance Records Become the Only Honest SignalMarch 8, 20266 min readCompliance & Audits PKI & Certificates
Domain Control Validation Grew Up. It Only Took Thirty Years.February 18, 202610 min readPKI & Certificates
"A Few Hours" and the Slow Erosion of Auditable CommitmentsFebruary 12, 20269 min readCompliance & Audits PKI & Certificates
Another Sleeping Giant: Microsoft’s Root Program and the 1.1.1.1 Certificate SlipSeptember 3, 20257 min readPKI & Certificates Compliance & Audits
How Microsoft Code Signing Became Part of a Trust Subversion ToolchainAugust 21, 202514 min readPKI & Certificates Security Practice
How Let's Encrypt Changed EverythingJune 17, 20255 min readPKI & Certificates
WebPKI Market Analysis: Mozilla Telemetry vs Certificate Transparency DataJune 16, 20254 min readPKI & Certificates
What Does CPA Canada Have to Do With the WebPKI Anyway?June 14, 20255 min readPKI & Certificates Compliance & Audits
The WebPKI's Moral Hazard Problem: When Those Who Decide Don't Pay the PriceJune 12, 20259 min readPKI & Certificates Compliance & Audits
Why CP and CPSs Matter More Than You ThinkJune 4, 20255 min readPKI & Certificates Compliance & Audits
Déjà Vu in the WebPKIMay 30, 20254 min readPKI & Certificates Compliance & Audits
Incident Response Done Right: A CA’s Guide to ResilienceFebruary 26, 20256 min readPKI & Certificates Compliance & Audits
How Organizational Inertia Externalizes Risk in the WebPKIFebruary 23, 20255 min readPKI & Certificates Compliance & Audits
What Makes a QR Code Verifiable?January 22, 20254 min readCryptography & Keys PKI & Certificates
Safeguarding Internet Trust: From Reactive to Continuous December 16, 20248 min readPKI & Certificates Compliance & Audits
Government CAs and the WebPKI: Trust is Often the Opposite of SecurityDecember 1, 20245 min readPKI & Certificates Compliance & Audits
Another CA Fails the Turing Test?November 30, 20242 min readPKI & Certificates Compliance & Audits
From Years to Seconds: Rethinking Public Key InfrastructureNovember 27, 20245 min readPKI & Certificates Identity & Authentication
CA Misissuance: A Tale of Two Incident ResponsesAugust 2, 20247 min readPKI & Certificates Compliance & Audits
Exploring Requirements for Timelines Certificate Problem Reports and RevocationsJuly 30, 20249 min readPKI & Certificates Compliance & Audits
Content is King in Phishing and the Role of Publicly Trusted CAsJuly 11, 20248 min readPKI & Certificates Security Practice
Understanding Patterns in WebPKI CA IssuesJune 28, 20242 min readPKI & Certificates Compliance & Audits
Exploring Browser DistrustJune 27, 20245 min readPKI & Certificates Compliance & Audits
Navigating Public Reporting Obligations in WebPKI and BeyondJune 27, 20246 min readPKI & Certificates Compliance & Audits
Why We Trust WebPKI Root Certificate AuthoritiesJune 26, 20243 min readPKI & Certificates Standards & Governance
From Static to Dynamic: Adapting PKI for Cloud-Native ArchitecturesJune 19, 20244 min readPKI & Certificates Identity & Authentication
ACME vs. SPIFFE: Choosing the Right OneJune 17, 20243 min readIdentity & Authentication PKI & Certificates Standards & Governance
How TLS Certificates Can Authenticate DNS TXT RecordsApril 29, 20242 min readPKI & Certificates Engineering & Code
Navigating Content Authentication In the Age of Generative AIFebruary 26, 20243 min readAI PKI & Certificates
Challenges in Digital Content Authentication and the Persistent Battle Against FakesFebruary 5, 20243 min readAI PKI & Certificates
Effortless Certificate Lifecycle Management for S/MIMEDecember 18, 20233 min readPKI & Certificates
The Rise of Key Transparency and Its Potential Future in Email SecurityDecember 18, 20235 min readCryptography & Keys PKI & Certificates
Document Authenticity in the Age of Generative AISeptember 9, 20238 min readAI PKI & Certificates
The Scale of Consequence: Storm-0558 vs DigiNotarSeptember 9, 20231 min readSecurity Practice PKI & Certificates
Towards Greater Accountability: A Proposal for CA Issuance Decision LogsMarch 21, 20232 min readPKI & Certificates Compliance & Audits
Exploring the Potential of Domain Control Notaries for MPDV in WebPKIMarch 21, 20233 min readPKI & Certificates
Strengthening Domain Control Verification: The Role of Multiple Perspectives and CollaborationMarch 21, 20232 min readPKI & Certificates Security Practice
Key Management and preparing for the Crypto ApocalypseMarch 19, 20232 min readCryptography & Keys PKI & Certificates
Using Caddy with Google Trust ServicesJanuary 20, 20232 min readPKI & Certificates Engineering & Code
To err is human, to forgive is divineDecember 1, 20221 min readPKI & Certificates Compliance & Audits
A Boy Scout is always preparedNovember 30, 20222 min readPKI & Certificates
Baseline requirements are just that a baselineNovember 28, 20222 min readPKI & Certificates Compliance & Audits
TOFU and the WebNovember 27, 20226 min readPKI & Certificates
Top #5 CAs by issuance volume as of 09/19/22September 19, 20221 min readPKI & Certificates
User-managed smart cards are an oxymoronAugust 26, 20222 min readIdentity & Authentication PKI & Certificates
Getting an EV Code Signing Certificate in 2022August 26, 20223 min readPKI & Certificates Engineering & Code
How to keep bad actors out in open ecosystemsAugust 22, 20224 min readPKI & Certificates Security Practice
What would it look like to go back to first principles when it comes to root store management in 2022?August 19, 20225 min readPKI & Certificates Compliance & Audits
WebPKI, TLS, cross-signs, device compatibility, and TLS record size.August 16, 202210 min readPKI & Certificates
Why crawling is not an adequate measurement methodology for the WebPKIAugust 2, 20221 min readPKI & Certificates
How to measure the WebPKI ecosystemJuly 29, 20225 min readPKI & Certificates
How is ACME different than XCEP/WSTEP anyway?March 30, 20214 min readPKI & Certificates Standards & Governance
The next decade of Public Key Infrastructure…March 29, 20218 min readPKI & Certificates Standards & Governance
What value can a third-party provide users when browsing the web?June 10, 20183 min readPKI & Certificates
Positive Trust Indicators and SSLJuly 29, 20173 min readPKI & Certificates
Let's talk about revocation checking, let's talk about you and me.May 5, 20174 min readPKI & Certificates
My response, to his response, to my response? or short-lived certificates part 3May 5, 20176 min readPKI & Certificates
It is my turn, or short-lived certificates part 2May 4, 20174 min readPKI & Certificates
Why bother with short-lived certificates and keys in TLS?May 3, 20173 min readPKI & Certificates Cryptography & Keys
Revocation reasons don’t make sense for the WebPKI of todayApril 29, 20174 min readPKI & Certificates
Secondary effects when encrypting the webApril 29, 20175 min readPKI & Certificates Security Practice
Digital Signatures and the fallacy of Good, Cheap and Fast.April 9, 20175 min readPKI & Certificates
CAs and SSL and Phishing Oh My!April 1, 20177 min readPKI & Certificates Security Practice
Do PDFs have to be so frustrating?March 16, 20173 min readEngineering & Code PKI & Certificates
XMLDSIG and XAdES in the browser and NodeMay 6, 20161 min readPKI & Certificates Engineering & Code
Escaping the Same-origin Policy for PKIjsJanuary 10, 20163 min readEngineering & Code PKI & Certificates
The PKCS#12 standard needs another updateDecember 2, 20159 min readPKI & Certificates Cryptography & Keys Standards & Governance
Certificate based Encryption in PDFsNovember 10, 20157 min readPKI & Certificates Cryptography & Keys Standards & Governance
PKIjs and trust listsOctober 28, 20151 min readPKI & Certificates Engineering & Code
Paper in a Digital WorldSeptember 11, 20153 min readPKI & Certificates
Uniform Electronic Legal Material Act and Digital SignaturesJuly 30, 20153 min readStandards & Governance PKI & Certificates
Blockchain, Digital Signatures and IdentityJune 15, 20153 min readBitcoin Identity & Authentication PKI & Certificates
What makes an enforceable electronic signature?June 15, 20153 min readPKI & Certificates Standards & Governance
Removing Friction From Online SignaturesMay 22, 20152 min readPKI & Certificates Identity & Authentication
Wet, Dry, Electronic, Digital and Hybrid SignaturesMay 15, 20154 min readPKI & Certificates
Browser Bound CertificatesMay 12, 20151 min readPKI & Certificates
A look at short lived certificates, keys and the relevance of FIPS 140-2May 12, 20155 min readPKI & Certificates Cryptography & Keys Compliance & Audits
Key management and key lifetimeMay 12, 20153 min readCryptography & Keys PKI & Certificates
My thoughts on Let’s EncryptMay 8, 20154 min readPKI & Certificates
How did I get involved in PKI?October 31, 20146 min readPKI & Certificates Leadership & Product
The first web-server and the meaning of the SSL lockSeptember 30, 20145 min readPKI & Certificates
What are some upsides of googles’s SHA1 deprecation plan?August 29, 20142 min readPKI & Certificates Cryptography & Keys
Why might you have a certificate with a SHA1 based signature in its chain that is valid beyond 2016/1/1?August 28, 20143 min readPKI & Certificates Cryptography & Keys
What will Chrome’s SHA1 early warning look like?August 28, 20141 min readPKI & Certificates Cryptography & Keys
Cupid and Understanding Your ExposureJune 2, 20142 min readSecurity Practice PKI & Certificates
Certificate Path Building in PKIjsMay 4, 20142 min readPKI & Certificates Engineering & Code
MUST STAPLE and PKI.jsApril 28, 20141 min readPKI & Certificates Engineering & Code
Generating signed messages using CMS and PKI.jsApril 28, 20141 min readPKI & Certificates Engineering & Code Cryptography & Keys
Frankencerts, new extensions and PKI.jsApril 26, 20142 min readPKI & Certificates Engineering & Code
Potential projects for PKI.JSApril 25, 20141 min readEngineering & Code PKI & Certificates
WebCrypto and PKIApril 25, 20143 min readCryptography & Keys PKI & Certificates Engineering & Code
What's in a certificate chain and why?October 16, 20134 min readPKI & Certificates
How to generate and send a timestamp request for AuthenticodeSeptember 16, 20132 min readPKI & Certificates Engineering & Code
How to generate and send an RFC3161 timestamp with OpenSSL and curlSeptember 16, 20131 min readPKI & Certificates Engineering & Code
The (soon to be) not-so Common NameAugust 14, 20134 min readPKI & Certificates Standards & Governance
Windows Certificate Enrollment ProtocolsJuly 8, 20131 min readPKI & Certificates Engineering & Code
Deploying forward secrecy on RedHat, Centos or Fedora based systemsJune 30, 20133 min readPKI & Certificates Cryptography & Keys Engineering & Code
Example IIS SSL / TLS configurationJune 25, 20131 min readPKI & Certificates Engineering & Code
Deploying SSL – Beyond the certificate and cipher suitesJune 24, 20135 min readPKI & Certificates Security Practice
Deploying SSL – How to get your server configuration rightJune 23, 20135 min readPKI & Certificates Security Practice
Example Nginx SSL / TLS configurationMay 29, 20132 min readPKI & Certificates Engineering & Code
Average CRL size and download timeApril 19, 20133 min readPKI & Certificates
A look at revocation repository uptimeApril 16, 20132 min readPKI & Certificates
Why we built the Revocation ReportApril 15, 20134 min readPKI & Certificates Engineering & Code
Certificate-based Mozilla Persona IdPApril 10, 20137 min readIdentity & Authentication PKI & Certificates
Microsoft Root Program and ExcelMarch 22, 20131 min readPKI & Certificates
Advanced Troubleshooting of Certificate Validation Related Problems on Windows Part 2March 8, 20133 min readPKI & Certificates Engineering & Code
Advanced Troubleshooting of Certificate Validation Related Problems on Windows Part 1March 7, 20132 min readPKI & Certificates Engineering & Code
Abstract: Using least privileged design principals to improve trust in the online marketplaceFebruary 16, 20131 min readPKI & Certificates Security Practice
Abstract: Revocation reality and the path to becoming effectiveFebruary 16, 20131 min readPKI & Certificates
Is SSL Broken?February 4, 20133 min readPKI & Certificates Security Practice
SSL 3.0 Usage in the WildDecember 5, 20123 min readPKI & Certificates Security Practice
Understanding Windows Automatic Root UpdateDecember 5, 20123 min readPKI & Certificates
How Facebook can avoid losing $100M in revenue when they switch to always-on SSLNovember 29, 20123 min readPKI & Certificates Engineering & Code
Making a Windows smartcard login certificate with OpenSSL.November 20, 20121 min readIdentity & Authentication PKI & Certificates Engineering & Code
Using CAPICOM on Windows x64November 18, 20121 min readEngineering & Code PKI & Certificates
Priming the OCSP cache in NginxNovember 15, 20121 min readPKI & Certificates Engineering & Code
What is the status of revocation checking in browsers? November 1, 20123 min readPKI & Certificates
Revocation checking, Chrome and CRLsetsNovember 1, 20122 min readPKI & Certificates
A quick look at SSL performanceOctober 22, 20123 min readPKI & Certificates Engineering & Code
Reading ocspreport and crlreport at x509labs.comOctober 15, 20122 min readPKI & Certificates
Logo for x509LabsSeptember 22, 20121 min readPKI & Certificates
RESTful X509, CRL and OCSP to JSON web-serviceSeptember 21, 20124 min readPKI & Certificates Engineering & Code
A look at revoked certificatesSeptember 21, 20121 min readPKI & Certificates
A look at untrusted certificatesSeptember 20, 20121 min readPKI & Certificates
A look at expired certificatesSeptember 20, 20122 min readPKI & Certificates
How to tell DV and OV certificates apartSeptember 11, 20123 min readPKI & Certificates
Windows XP and Name Constraints September 7, 20122 min readPKI & Certificates
Algorithms, key size and digital certificatesSeptember 4, 20124 min readCryptography & Keys PKI & Certificates Standards & Governance
XP and the undefined Name ConstraintsAugust 16, 20121 min readPKI & Certificates
Updated my script for Qualified Subordination testingAugust 16, 20121 min readPKI & Certificates Engineering & Code
Using ECC keys in X509 certificatesAugust 16, 20122 min readCryptography & Keys PKI & Certificates
Using SHA2 based signatures in X509 certificatesAugust 16, 20122 min readCryptography & Keys PKI & Certificates
How to get your own OID arcAugust 16, 20121 min readStandards & Governance PKI & Certificates
Government CAs in the Microsoft Root ProgramJuly 13, 20128 min readPKI & Certificates Standards & Governance
Serving OCSP POST responses on a CDNJuly 13, 20122 min readPKI & Certificates Engineering & Code
How to seed the CryptoAPI URL cache with an OCSP responseJuly 2, 20122 min readPKI & Certificates Engineering & Code
CryptoAPI, Revocation checking, OCSP and the Unknown certStatusJuly 2, 20122 min readPKI & Certificates Engineering & Code
Serving OCSP on a CDNJune 30, 20121 min readPKI & Certificates Engineering & Code
Using Monitis to monitor OCSP and CRL performanceJune 28, 20121 min readPKI & Certificates Engineering & Code
Revocation repositories, IPv6 support, message size, and performanceJune 27, 20123 min readPKI & Certificates Engineering & Code
A revised look at the new Windows Update SSL configurationJune 24, 20121 min readPKI & Certificates Security Practice
Setting HTTP headers with OpenSSL and the OCSP test clientJune 24, 20121 min readPKI & Certificates Engineering & Code
Measuring OCSP Responder Performance with PowershellJune 20, 20121 min readPKI & Certificates Engineering & Code
Pulse data publicly availibleJune 18, 20121 min readPKI & Certificates
A look at the new Windows Update SSL certificatesJune 17, 20127 min readPKI & Certificates Security Practice
What is your organizations policy on SSL?June 15, 20122 min readPKI & Certificates Standards & Governance
Redirecting HTTP to HTTPS in IISJune 15, 20122 min readEngineering & Code PKI & Certificates
Redirecting HTTP to HTTPS in ApacheJune 14, 20121 min readEngineering & Code PKI & Certificates
Was the Flame WSUS attack caused just because of the use of MD5?June 13, 20122 min readCryptography & Keys Security Practice PKI & Certificates
RSA keys under 1024 bits and youJune 13, 20122 min readCryptography & Keys PKI & Certificates
Testing OCSP StaplingJune 13, 20121 min readPKI & Certificates Engineering & Code
OCSP Stapling in IISJune 12, 20121 min readPKI & Certificates Engineering & Code
OCSP Stapling in ApacheJune 12, 20122 min readPKI & Certificates Engineering & Code
Flame and Certificate RevocationJune 12, 20122 min readPKI & Certificates Security Practice
Flame was just one use of the Terminal Services Licensing PKIJune 10, 20123 min readPKI & Certificates Security Practice
How did the Terminal Services Licensing PKI effect you?June 8, 20122 min readPKI & Certificates Security Practice
How one typically verifies code comes from MicrosoftJune 7, 20123 min readPKI & Certificates Security Practice
The tale of two (Microsoft) PKIs June 6, 20121 min readPKI & Certificates Security Practice
MSRC 2718704 and the age of the rogue certificatesJune 6, 20123 min readPKI & Certificates Security Practice
MSRC 2718704 and Terminal Services License CertificatesJune 6, 20122 min readPKI & Certificates Security Practice
MSRC 2718704 and Nested EKU enforcementJune 6, 20124 min readPKI & Certificates Security Practice
MSRC 2718704 and the Terminal Services Licensing ProtocolJune 4, 20124 min readPKI & Certificates Security Practice
Getting beyond 1% -- How do we increase the use of SSL? May 26, 20125 min readPKI & Certificates
Lightning talk on the “Improving the Availability of Revocation Information” workshop.May 23, 20121 min readPKI & Certificates
Transcript for Panel on Third-Party Trust Providers and SSL Best PracticesMay 18, 20121 min readPKI & Certificates Standards & Governance
Always On SSL (AOSSL) Whitepaper PublishedApril 24, 20121 min readPKI & Certificates Security Practice
My top PKI/TLS related issues in FirefoxApril 20, 20121 min readPKI & Certificates
Attending workshop on “Improving the Availability of Revocation Information”April 13, 20121 min readPKI & Certificates Standards & Governance
Browser Revocation Behavior Needs Improvement March 30, 20122 min readPKI & Certificates
OCSP Responder Performance Needs ImprovementMarch 22, 20122 min readPKI & Certificates Engineering & Code
How to do OCSP requests using OpenSSL and CURLMarch 20, 20121 min readPKI & Certificates Engineering & Code
Hard revocation checking and why it’s not here yet.March 11, 20121 min readPKI & Certificates
Using OpenSSL to create a test Qualified Subordination PKI hierarchyMarch 3, 20121 min readPKI & Certificates Engineering & Code
Least Privilege and Subordinate Certificate AuthoritiesFebruary 24, 20126 min readPKI & Certificates Security Practice
SSL/TLS Deployment Best PracticesFebruary 24, 20121 min readPKI & Certificates Security Practice
My first post since joining GlobalSignFebruary 23, 20121 min readLeadership & Product PKI & Certificates
How to clear the CryptNet cache in Windows 7August 31, 20112 min readPKI & Certificates Engineering & Code
How to mitigate the risk of the DigiNotar *.google.com SSL certificateAugust 27, 20113 min readPKI & Certificates Security Practice
How to clear the IE SSL Cache from JSAugust 28, 20071 min readPKI & Certificates Engineering & Code
What is a wildcard certificate and why are they a bad idea?August 17, 20073 min readPKI & Certificates Security Practice
Understanding Server Gated CryptographyDecember 6, 20067 min readPKI & Certificates Cryptography & Keys