CT-Monitor++: Improving the Certificate Transparency Ecosystem with Cryptographic and Security Checks

Abstract

: Digital certificates are one of the main tools to provide data and public key authentication, but their use in a Public Key Infrastructure (PKI) relies on the trustworthiness of each individual Certification Authority (CA), which may be compromised or act maliciously. Certificate Transparency (CT) mitigates this risk by requiring all issued certificates to be publicly logged, enabling the detection of unauthorized certificates. In this work, we present the design of a CT monitor that goes beyond traditional domain-based tracking by performing systematic security analysis on all certificates recorded in public CT logs. Our monitor executes a comprehensive set of security checks, inspecting certificates for cryptographic weaknesses, syntactic inconsistencies, and potentially malicious contents, providing real-time insights into the security of the Web PKI ecosystem. We implement and evaluate our monitor on live CT log streams, analyzing its computational overhead, memory requirements, and scalability as certificate volumes increase. We quantify the resources needed to perform these analyses in real time and show that, with the proposed optimizations, our monitor is capable of keeping up with the current certificate issuance rates while performing all security checks.