statcert: a new tool to identify the type of X.509 certificates and their revocation status

-

Today three types of certificates are used by the web: DV, OV, and EV. The DV certificates only ensure that the certificate owner has the right to control the domain name. Still, it doesn't provide any information about the owner's identity. On the other hand, the OV certificate lets one know that the owner has the right to use the domain name, but it gives more information about the domain name's owner, such as the organization name and the country. Finally, the EV certificates are similar to OV, but they provide more information about the owner, and the verification procedures of the owner information are more strict.

Web users have to trust a website that uses an EV certificate more than a website that uses a DV or OV certificate. However, it is difficult for a web user to distinguish these certificates as the web browsers have decided to remove all the visual indicators for EV certificates.

We have built a new tool called statcert that allows us to know the type of X.509 certificate used by any website. The tool can be installed from this GitHub repository :

https://github.com/SamerW/statcert

This tool can also be used to check the revocation status of certificates. Some web browsers, such as Google Chrome, don't check the certificate status for OV and DV certificates. A user can use our tool to check the status of any certificate.

In addition, our tool can allow us to understand the trend of the web PKI market to know the types of certificates that are the most dominant. The tool automatically downloads the list of one top million websites from Tranco List (https://tranco-list.eu) and generates a report to give the number of EV, OV, and DV certificates found on these websites. The number of websites to check can be reduced to any value less than one million so that the user can reduce the time needed to generate the report. We are using Tranco List and not Alexa of Amazon because Tranco List provides a more reliable list that is hardened against manipulation.

I give here some quick examples:

statcert google.com --ocsp: allow to download the certificate of the web server of google.com domain and check its ocsp status (whether the certificate is revoked or not)



I can use the tool to check different domains simultaneously, but I will add the -v option that allows me to see the report generated for the three domains. Here is one example:

statcert -v google.com zu.ac.ae facebook.com --ocsp


 



Finally, I use the tool to check the types of certificates for the top 20 websites according to Tranco List. The generated report shows that only one website uses an EV certificate, while 13 websites use OV certificates and 5 websites use DV certificates.















Comments

Post a Comment

Popular posts from this blog

ChatGPT or CheatGPT? The impact of ChatGPT on education

-
Image
On November 30, OpenAI launched its AI chatbot called ChatGPT. ChatGPT is the most important revolution we have ever had on the Internet, much more important than Blockchains and NFTs. The capacities of ChatGPT are phenomenal. It can do many things, such as writing poems, writing and summarising articles, writing and debugging codes, and solving puzzles and mathematical questions. In addition, the ChatGPT tool can also be used with other tools such as DALL.E 2 (https://openai.com/dall-e-2/) to generate drawings or the Philosopher AI to answer philosophical questions (https://philosopherai.com/). Some tools can also allow the creation of music based on our lyrics. For example, we may use ChatGPT to generate some lyrics and give them to another AI tool to develop our song. If we look at the impacts of these tools pessimistically, the development of AI tools would mean the end of human intelligence and the triumph of human stupidity when only influential individuals can access these tools...
Read more

What does information security really mean?

-
Security is defined by Meriam-Webster Dictionary  [1] as  the quality or state of being secure.  Secure itself is defined as :  free from danger  or free from risk of loss If we have one million dollars and live in a utopian world, we will not be worried about the dangers that could exist to our money. We may leave our money in the street and label them with our name; no one will take them. Thus, the security and even trust concepts are not relevant in this world because we are sure that everyone is good and has good intentions. In a dystopian world, we are almost sure that dangers exist. Therefore, almost everyone is interested in our assets. In this world, Security is critical as it is the only way that allows us to survive. Trust is relevant also but should be used much less frequently than Security.   In the real world, we are between the utopia and dystopia worlds. We are not sure about the existence or absence of dangers, and yet we need to make decis...
Read more

Abstract Mathematical Explanation with Examples for Neural Networks

-
Image
In this article, I will explain the core ideas of neural networks from an abstract mathematical perspective. By "abstract", I mean that I will try to explain the "why" of mathematical concepts without covering all mathematical details. To simplify the mathematical concepts of neural networks, I will use some analogies from real life situations, with visualisations and examples.  I will start by explaining why we need neural networks, and then discuss the role of optimisation and backpropagation algorithms.  Why Do We Need Neural Networks  Neural networks are tools that allow us to approximate complex multivariate functions representing the relationships between dataset inputs and outputs. Typically, it is not feasible to define one explicit equation that can reproduce these multivariate functions. The role of training is thus to approximate them. Indeed, most neural networks architectures are based on a mathematical theorem called Universal Approximation Theorem. Th...
Read more