Making heads or tails of TLS certificate errors
summary
A research project catalogs certificate validation failures across OpenSSL GnuTLS Botan mbedTLS and NSS, finding 78 OpenSSL errors and over 100 in NSS, and builds x509errors.org with consolidated docs, example certificate chains that reproduce specific errors, and cross-library mappings. Usability tests (180 participants; earlier lab work showed 87% thought they created a cert vs 45% success) show the rewritten docs reduce ambiguity and incompleteness and 89% of testers prefer the new docs; plans add more libraries, client guides and revocation guidance.
AI-written summary · about
chapters (8)
- 0:00Intro
- 2:13How many TLS certificate errors
- 4:33X509 errors website
- 9:41Average documentation
- 15:39Data analysis
- 16:33Certificate validation
- 17:43Revocation checking
- 19:30Wrap up
related talks
25mUntangling the certificate error messages
51mUnderstanding TLS certificate validation errors
30mHashiTLS: Demystifying Security Certs
46mMastering TLS, OpenSSL and Certificates
27mDebugging TLS/SSL
01h 01mHTTPS & TLS in 2016: Security practices from the front lines
48mChain of Fools: An Exploration of Certificate Chain Validation Mishaps
13mX.509DoS: Exploiting and Detecting Denial-of-Service Vulnerabilities in