Internet users today depend daily on HTTPS for secure communication with sites they intend to visit. Over the years, many attacks on HTTPS and the certificate trust model it uses have been hypothesized, executed, and/or evolved. Meanwhile the number of browser-trusted (and thus, de facto, user-trusted) certificate authorities has proliferated, while the due diligence in baseline certificate issuance has declined. We survey and categorize prominent security issues with HTTPS and provide a systematic treatment of the history and on-going challenges, intending to provide context for future directions. We also provide a comparative evaluation of current proposals for enhancing the certificate infrastructure used in practice.

Additional Metadata
Keywords browser trust model, certificates, SSL, usability
Persistent URL dx.doi.org/10.1109/SP.2013.41
Conference 34th IEEE Symposium on Security and Privacy, SP 2013
Citation
Clark, J. (Jeremy), & Van Oorschot, P. (2013). SoK: SSL and HTTPS: Revisiting past challenges and evaluating certificate trust model enhancements. Presented at the 34th IEEE Symposium on Security and Privacy, SP 2013. doi:10.1109/SP.2013.41