Links: Bulletproof TLS and PKI 2ed

Below are all the links from the second edition of Bulletproof TLS and PKI. We occasionally run through the entire list to check and fix broken entries. As a result, the links here might not be exactly the same as the ones in the earlier digital releases.

1. SSL, TLS, and Cryptography

• Photos of an NSA “upgrade” factory show Cisco router getting implant t10

  https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/
• RFC 7258: Pervasive Monitoring Is an Attack t12

  https://tools.ietf.org/html/rfc7258
• GCHQ taps fibre-optic cables for secret access to world's communications t11

  https://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
• A Syrian Man-in-the-Middle Attack against Facebook t14

  https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against-facebook
• Transparency Report t13

  https://transparencyreport.google.com
• Attacking Tor: How the NSA Targets Users' Online Anonymity t15

  https://www.schneier.com/essays/archives/2013/10/attacking_tor_how_th.html
• Security Standards and Name Changes in the Browser Wars t1

  http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html
• la cryptographie militaire t2

  https://www.petitcolas.net/kerckhoffs/
• RFC 2104: HMAC: Keyed-Hashing for Message Authentication t3

  https://tools.ietf.org/html/rfc2104
• ECRYPT2 Yearly Report on Algorithms and Keysizes t4

  http://www.ecrypt.eu.org/
• Cryptographic Key Length Recommendation t5

  https://www.keylength.com/
• NIST Special Publication 800-57: Recommendation for Key Management—Part 1: General, Revision 5 t6

  https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
• Universal security; from bits and mips to pools, lakes—and beyond t7

  https://eprint.iacr.org/2013/635
• The Creepy, Long-Standing Practice of Undersea Cable Tapping t8

  https://www.theatlantic.com/international/archive/2013/07/the-creepy-long-standing-practice-of-undersea-cable-tapping/277855/
• New Details About NSA’s Collaborative Relationships With America’s Biggest Telecom Companies From Snowden Docs t9

  https://web.archive.org/web/20150927143918/http://www.matthewaid.com/post/59765378513/new-details-about-nsas-collaborative

2. TLS 1.3

• RFC 8446: The Transport Layer Security Protocol Version 1.3 t16

  https://tools.ietf.org/html/rfc8446
• IANA: Transport Layer Security (TLS) Extensions t18

  https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
• TLS Version Intolerance in SSL Pulse t17

  https://blog.qualys.com/product-tech/2016/08/02/tls-version-intolerance-in-ssl-pulse
• RFC 8470: Using Early Data in HTTP t19

  https://datatracker.ietf.org/doc/html/rfc8470

3. TLS 1.2

• Wireshark t21

  https://www.wireshark.org/
• RFC 5246: The Transport Layer Security Protocol Version 1.2 t20

  https://datatracker.ietf.org/doc/html/rfc5246
• TLS Working Group mailing list archives t23

  http://www.ietf.org/mail-archive/web/tls/current/
• TLS Working Group documents t22

  https://datatracker.ietf.org/wg/tls/documents/
• RFC 5081: Using OpenPGP Keys for TLS Authentication t25

  https://datatracker.ietf.org/doc/html/rfc5081
• Deprecating gmt_unix_time in TLS t24

  https://datatracker.ietf.org/doc/html/draft-mathewson-no-gmtunixtime-00
• RFC 3447: RSA Cryptography Specifications Version 2.1 t27

  https://tools.ietf.org/html/rfc3447
• The Alert attack t26

  https://www.mitls.org/pages/attacks/Alert
• Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS t29

  https://datatracker.ietf.org/doc/draft-ietf-tls-negotiated-ff-dhe/
• Public Key Cryptography: Diffie-Hellman Key Exchange t28

  https://www.youtube.com/watch?v=3QnD2c4Xovk
• RFC 7366: Encrypt-then-MAC for TLS and DTLS t30

  https://datatracker.ietf.org/doc/rfc7366/
• Tor Protocol Specification t32

  https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt
• RFC 7905: ChaCha20-Poly1305 Cipher Suites for TLS t31

  https://datatracker.ietf.org/doc/rfc7905/
• RFC 7685: A TLS ClientHello Padding Extension t34

  https://datatracker.ietf.org/doc/rfc7685/
• TLS Parameters t33

  https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
• Certificate Transparency t36

  https://certificate.transparency.dev
• RFC 7301: TLS Application-Layer Protocol Negotiation Extension t35

  https://tools.ietf.org/html/rfc7301
• FIPS 186-3: Digital Signature Standard t38

  https://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
• RFC 4492: ECC Cipher Suites for TLS t37

  https://tools.ietf.org/html/rfc4492
• RFC 7027: ECC Brainpool Curves for TLS t39

  https://tools.ietf.org/html/rfc7027
• SafeCurves: choosing safe curves for elliptic-curve cryptography t41

  https://safecurves.cr.yp.to
• ECC Cipher Suites for TLS 1.2 and Earlier t40

  https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/
• Google Technical Note: TLS Next Protocol Negotiation Extension t43

  https://web.archive.org/web/20150529234248/https://technotes.googlecode.com/git/nextprotoneg.html
• RFC 6520: TLS and DTLS Heartbeat Extension t42

  https://tools.ietf.org/html/rfc6520
• Some missing context (was: Confirming consensus for ALPN) t45

  https://www.ietf.org/mail-archive/web/tls/current/msg09344.html
• Next Protocol Negotiation 03 t44

  https://www.ietf.org/mail-archive/web/tls/current/msg08678.html
• RFC 5077: TLS Session Resumption without Server-Side State t47

  https://tools.ietf.org/html/rfc5077
• RFC 6066: TLS Extensions: Extension Definitions t46

  http://tools.ietf.org/html/rfc6066
• Analysis of the SSL 3.0 protocol t49

  https://www.schneier.com/cryptography/paperfiles/paper-ssl-revised.pdf
• RFC 6961: TLS Multiple Certificate Status Request Extension t48

  https://tools.ietf.org/html/rfc6961

4. Public Key Infrastructure

• Simple Certificate Enrolment Protocol t100

  https://tools.ietf.org/html/rfc8894
• Internet X.509 PKI Certificate Management Protocol t102

  https://tools.ietf.org/html/rfc4210
• Enrollment over Secure Transport t101

  https://tools.ietf.org/html/rfc7030
• Open Data t122

  https://opendata.rapid7.com
• zmap t121

  https://github.com/zmap/zmap
• Web PKI: Closing the Gap between Guidelines and Practices t124

  https://www.microsoft.com/en-us/research/publication/web-pki-closing-the-gap-between-guidelines-and-practices/
• A novel method in IE11 for dealing with fraudulent digital certificates t123

  https://docs.microsoft.com/en-us/archive/blogs/pki/a-novel-method-in-ie11-for-dealing-with-fraudulent-digital-certificates
• Analysis of the HTTPS Certificate Ecosystem t120

  https://conferences.sigcomm.org/imc/2013/papers/imc257-durumericAemb.pdf
• The ICSI SSL Notary: CA Certificates t119

  https://notary.icsi.berkeley.edu/trust-tree/
• The ICSI Certificate Notary t118

  https://notary.icsi.berkeley.edu/
• HTTPS Everywhere & the Decentralized SSL Observatory t115

  https://www.eff.org/deeplinks/2012/02/https-everywhere-decentralized-ssl-observatory
• The EFF SSL Observatory t114

  https://www.eff.org/observatory
• SSL Pulse t117

  https://www.ssllabs.com/ssl-pulse/
• The SSL Landscape - A Thorough Analysis of the X.509 PKI Using Active and Passive Measurements t116

  https://conferences.sigcomm.org/imc/2011/docs/p427.pdf
• The Sovereign Keys Project t111

  https://www.eff.org/sovereign-keys
• Convergence t110

  https://web.archive.org/web/20150527165611/http://convergence.io/
• Internet SSL Survey 2010 is here! t113

  https://blog.ivanristic.com/2010/07/internet-ssl-survey-2010-is-here.html
• Mutually Endorsing CA Infrastructure version 2 t112

  https://kuix.de/mecai/
• The Security Impact of HTTPS Interception t108

  https://jhalderm.com/pub/papers/interception-ndss17.pdf
• Bamboozling Certificate Authorities with BGP t107

  https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee
• Perspectives Project t109

  http://perspectives-project.org
• ACME Working Group t104

  https://datatracker.ietf.org/wg/acme/about/
• Let’s Encrypt t103

  https://letsencrypt.org
• Clarifying The Trustwave CA Policy Update t106

  https://www.trustwave.com/Resources/SpiderLabs-Blog/Clarifying-The-Trustwave-CA-Policy-Update/
• RFC 8555: Automatic Certificate Management Environment t105

  https://tools.ietf.org/html/rfc8555
• Censys t126

  https://censys.io
• crt.sh t125

  https://crt.sh/
• The Rise of Certificate Transparency and Its Implications on the Internet Ecosystem t128

  https://arxiv.org/pdf/1809.08325.pdf
• Tracking Certificate Misissuance in the Wild t127

  https://zakird.com/papers/zlint.pdf
• PKIX Working Group t50

  https://datatracker.ietf.org/wg/pkix/charter/
• The CA/Browser Forum t52

  https://cabforum.org/
• RFC 5280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile t51

  https://tools.ietf.org/html/rfc5280
• Baseline Requirements t54

  https://cabforum.org/baseline-requirements/
• EV SSL Certificate Guidelines t53

  https://cabforum.org/extended-validation/
• X.680 : Information technology - ASN.1 t56

  https://www.itu.int/rec/T-REC-X.680
• WebTrust seal program t55

  https://www.cpacanada.ca/en/business-and-accounting-resources/audit-and-assurance/overview-of-webtrust-services
• A Warm Welcome to ASN.1 and DER t58

  https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
• ASN.1 JavaScript decoder t57

  https://lapo.it/asn1js/
• der-ascii t59

  https://github.com/google/der-ascii
• Chain of Trust t61

  https://letsencrypt.org/certificates/
• Bug 725451: Support enforcing nested EKU constraints, do so by default t60

  https://bugzilla.mozilla.org/show_bug.cgi?id=725351
• Preloading Intermediate CA Certificates into Firefox t63

  https://blog.mozilla.org/security/2020/11/13/preloading-intermediate-ca-certificates-into-firefox/
• Standing on Our Own Two Feet t62

  https://letsencrypt.org/2020/11/06/own-two-feet.html
• Available trusted root certificates for Apple operating systems t65

  https://support.apple.com/en-us/HT209143
• Apple Root Certificate Program t64

  https://www.apple.com/certificateauthority/ca_program.html
• Program Requirements - Microsoft Trusted Root Program t67

  https://docs.microsoft.com/en-us/security/trusted-root/program-requirements
• Chrome Root Program t66

  https://www.chromium.org/Home/chromium-security/root-ca-policy
• dev-security-policy t69

  https://groups.google.com/a/mozilla.org/g/dev-security-policy
• Mozilla CA Certificate Policy t68

  https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/
• ocsp-stapling.md t70

  https://gist.github.com/sleevi/5efe9ef98961ecfb4da8
• Improving Revocation: OCSP Must-Staple and Short-lived Certificates t72

  https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/
• X.509v3 TLS Feature Extension t71

  https://tools.ietf.org/html/rfc7633
• Certificate Transparency t74

  https://www.imperialviolet.org/2011/11/29/certtransparency.html
• Fixing CAs t73

  https://www.links.org/?p=1212
• certificate-transparency mailing list t76

  https://groups.google.com/u/1/g/certificate-transparency
• The Right Key mailing list t75

  https://www.ietf.org/mailman/listinfo/therightkey
• Sustaining Digital Certificate Security t78

  https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html
• Extended Validation in Chrome t77

  https://www.certificate-transparency.org/ev-ct-plan
• Announcement: Requiring Certificate Transparency in 2017 t79

  https://groups.google.com/a/chromium.org/g/ct-policy/c/78N3SMcqUGw/m/ykIwHXuqAQAJ
• Issue 679012: Expect-CT HTTP header t81

  https://bugs.chromium.org/p/chromium/issues/detail?id=679012
• Certificate Transparency in Chrome - Change to Enforcement Date t80

  https://groups.google.com/a/chromium.org/g/ct-policy/c/sz_3W_xKBNY/m/6jq2ghJXBAAJ
• [Trans] WGLC comments on draft-ietf-trans-6962-bis-24 t83

  https://mailarchive.ietf.org/arch/msg/trans/gO_DFW3v9FmBCOek_hifZ6KL368/
• Apple's Certificate Transparency policy t82

  https://support.apple.com/en-us/HT205280
• Trillian t85

  https://github.com/google/trillian
• How will Certificate Transparency Logs be Audited in Practice? t84

  https://www.agwa.name/blog/post/how_will_certificate_transparency_logs_be_audited_in_practice
• Certificate Transparency: SCT Auditing t87

  https://www.hardenize.com/blog/certificate-transparency-sct-auditing
• Tamper-Evident Logs t86

  https://transparency.dev
• Certificate Transparency Version 2.0 t89

  https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/
• RFC 6962: Certificate Transparency t88

  https://datatracker.ietf.org/doc/rfc6962/
• Chromium Certificate Transparency Policy t90

  https://github.com/chromium/ct-policy
• Ballot 181—Make CAA Checking Mandatory t92

  https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/
• RFC 8659: DNS CAA Resource Record t91

  https://tools.ietf.org/html/rfc8659
• CAA Record Generator t94

  https://sslmate.com/labs/caa/
• Who Supports CAA? t93

  https://sslmate.com/caa/support
• RFC 8657: CAA Record Extensions for Account URI and ACME Method Binding t96

  https://tools.ietf.org/html/rfc8657
• CAA Test Suite t95

  https://caatestsuite.com
• A First Look at Certification Authority Authorization t98

  https://taejoong.github.io/pubs/publications/quirin-2018-caa.pdf
• CAA incidents in Mozilla’s issue tracker t97

  https://bugzilla.mozilla.org/buglist.cgi?short_desc_type=allwordssubstr&component=CA%20Certificate%20Compliance&component=CA%20Certificate%20Root%20Program&resolution=FIXED&resolution=INVALID&resolution=WONTFIX&resolution=INACTIVE&resolution=DUPLICATE&resolution=WORKSFORME&resolution=INCOMPLETE&resolution=SUPPORT&resolution=EXPIRED&resolution=MOVED&query_format=advanced&classification=Client%20Software&classification=Developer%20Infrastructure&classification=Components&classification=Server%20Software&classification=Other&list_id=15711306&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&short_desc=CAA
• CAA Study t99

  https://caastudy.github.io

5. Attacks against PKI

• Distrusting New CNNIC Certificates t201

  https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/
• Maintaining digital certificate security t200

  https://googleonlinesecurity.blogspot.co.uk/2015/03/maintaining-digital-certificate-security.html
• Distrusting WoSign and StartCom Certificates t221

  https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html
• Distrusting New WoSign and StartCom Certificates t220

  https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/
• SHAttered  t223

  https://shattered.io/
• Announcing the first SHA1 collision t222

  https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
• Kazakhstan’s HTTPS Interception Live (Again) t218

  https://censoredplanet.org/kazakhstan/live
• Kazakhstan government is intercepting HTTPS traffic in its capital t217

  https://www.zdnet.com/article/kazakhstan-government-is-intercepting-https-traffic-in-its-capital/
• CA:WoSign Issues t219

  https://wiki.mozilla.org/CA:WoSign_Issues
• Protecting Chrome users in Kazakhstan t214

  https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html
• Google and Mozilla block Kazakhstan root CA certificate from Chrome and Firefox t213

  https://venturebeat.com/2019/08/21/google-and-mozilla-block-kazakhstan-root-ca-certificate-from-chrome-and-firefox/
• Kazakhstan’s HTTPS Interception t216

  https://censoredplanet.org/kazakhstan
• Protecting our Users in Kazakhstan t215

  https://blog.mozilla.org/security/2019/08/21/protecting-our-users-in-kazakhstan/
• Add Symantec Test Certs to OneCRL t210

  https://bugzilla.mozilla.org/show_bug.cgi?id=1214321
• Vice Minister: Installing a "security certificate" is up to users t212

  https://rus.azattyq.org/a/30064788.html
• Kazakhtelecom JSC notifies on introduction of National security certificate from 1 January 2016 t211

  https://web.archive.org/web/20151202203337/http://telecom.kz/en/news/view/18729
• Dates for phasing out MD5-based signatures and 1024-bit moduli t207

  https://wiki.mozilla.org/CA:MD5and1024
• Google certificates upgrade in progress t206

  https://developers.googleblog.com/2013/07/google-certificates-upgrade-in-progress.html
• Improved Digital Certificate Security t209

  https://security.googleblog.com/2015/09/improved-digital-certificate-security.html
• Bug #1156844 - Turn off trust bits for Equifax Secure Certificate Authority 1024-bit root certificate t208

  https://bugzilla.mozilla.org/show_bug.cgi?id=1156844
• HTTPS Everywhere t203

  https://www.eff.org/https-everywhere
• Consequences of mis-issuance under CNNIC t202

  https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/czwlDNbwHXM/Fj-LUvhVQYEJ
• Facebook's outmoded Web crypto opens door to NSA spying t205

  https://www.cnet.com/news/facebooks-outmoded-web-crypto-opens-door-to-nsa-spying/
• On the Cost of Factoring RSA-1024 t204

  https://www.tau.ac.il/~tromer/papers/cbtwirl.pdf
• How do you handle mass revocation requests? t243

  https://groups.google.com/g/mozilla.dev.security.policy/c/wxX4Yv0E3Mk
• RFC 8737: ACME TLS ALPN Challenge Extension t242

  https://tools.ietf.org/html/rfc8737
• @cujanovic’s tweet t245

  https://twitter.com/cujanovic/status/969229397508153350
• Distrusted Symantec® SSL Replacement t244

  https://www.trustico.com/news/2018/symantec-revocation/certificate-replacement.php
• How I exploited ACME TLS-SNI-01 t241

  https://labs.detectify.com/2018/01/12/how-i-exploited-acme-tls-sni-01-issuing-lets-encrypt-ssl-certs-for-any-domain-using-shared-hosting/
• Issue with TLS-SNI-01 and Shared Hosting Infrastructure t240

  https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996
• Ballot 169—Revised Validation Requirements t239

  https://cabforum.org/2016/08/05/ballot-169-revised-validation-requirements/
• Incident Report—OCR t236

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg04654.html
• Incident Report—certificate with 'sb' as a SAN:dnsName t235

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg04274.html
• Re: Incident Report—Certificates issued without proper domain validation t238

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05403.html
• Incident Report—Certificates issued without proper domain validation t237

  https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05398.html
• Chrome’s Plan to Distrust Symantec Certificates t232

  https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
• Re: Intent to Deprecate and Remove: Trust in existing Symantec-issued Certificates t231

  https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKwjihhBs/m/i70m8ptvCQAJ
• StartEncrypt considered harmful today t234

  https://www.computest.nl/blog/startencrypt-considered-harmful-today/
• DigiCert to Acquire Symantec’s Website Security Business t233

  https://www.digicert.com/dc/blog/digicert-to-acquire-symantec-website-security-business/
• Symantec: Mis-issued test certificates by CrossCert t230

  https://bugzilla.mozilla.org/show_bug.cgi?id=1334377
• Intent to Deprecate and Remove: Trust in existing Symantec-issued Certificates t229

  https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKwjihhBs
• SHA-1 is a Shambles t228

  https://sha-mbles.github.io
• SHA1 collisions make Git vulnerable to attacks by third-parties, not just repo maintainers t225

  https://www.metzdowd.com/pipermail/cryptography/2017-February/031623.html
• Tweet about SHA1 collision reuse t224

  https://twitter.com/realhashbreaker/status/835920234594861056
• New collision attacks on SHA-1 based on optimal joint local-collision analysis t227

  https://marc-stevens.nl/research/papers/EC13-S.pdf
• sha1collisiondetection t226

  https://github.com/cr-marcstevens/sha1collisiondetection
• Cryptanalysis of MD5 Compress t144

  https://cseweb.ucsd.edu/~bsy/dobbertin.ps
• Collisions for the compression function of MD5 t143

  https://securewww.esat.kuleuven.be/cosic/publications/article-143.pdf
• Colliding X.509 Certificates based on MD5-collisions t146

  https://www.win.tue.nl/~bdeweger/CollidingCertificates/
• Collisions for hash functions MD4, MD5, HAVAL-128, and RIPEMD t145

  https://eprint.iacr.org/2004/199.pdf
• Unbelievable! t140

  https://groups.google.com/forum/#!topic/mozilla.dev.tech.crypto/nAzIKSBEh78
• MD5 considered harmful today t142

  https://www.win.tue.nl/hashclash/rogue-ca/
• Re: Unbelievable!  t141

  https://groups.google.com/forum/#!msg/mozilla.dev.tech.crypto/nAzIKSBEh78/I1nFwuUkOF8J
• video t137

  https://www.youtube.com/watch?v=XCjoJePnRBY
• slides t136

  https://defcon.org/images/defcon-17/dc-17-presentations/defcon-17-zusman-hacking_pki.pdf
• SSL Certificate for Mozilla.com Issued Without Validation t139

  https://www.sslshopper.com/article-ssl-certificate-for-mozilla.com-issued-without-validation.html
• (Un)trusted Certificates t138

  https://web.archive.org/web/20110615055112/https://blog.startcom.org/?p=145
• A Finnish man created this simple email account - and received Microsoft's security certificate t133

  https://www.tivi.fi/uutiset/a-finnish-man-created-this-simple-email-account-and-received-microsofts-security-certificate/84101245-1867-37df-af1a-cd5d6ada7de8
• Mike's Thawte tweet t132

  https://twitter.com/schmoilito/statuses/1089348859
• Full Disclosure t135

  https://web.archive.org/web/20160312132143/https://blog.startcom.org/?p=161
• Nobody is perfect t134

  http://schmoil.blogspot.co.uk/2009/01/nobody-is-perfect.html
• DNS vuln + SSL cert = FAIL t131

  https://web.archive.org/web/20100809095612/http://intrepidusgroup.com/insight/2008/07/dns-vuln-ssl-cert-fail/
• Microsoft, VeriSign, and Certificate Revocation t130

  https://web.archive.org/web/20151225181749/http://amug.org/~glguerin/opinion/revocation.html
• Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard t129

  https://technet.microsoft.com/library/security/ms01-017
• Let's Encrypt: Incomplete revocation for CAA rechecking bug t247

  https://bugzilla.mozilla.org/show_bug.cgi?id=1619179
• Let's Encrypt: CAA Rechecking bug t246

  https://bugzilla.mozilla.org/show_bug.cgi?id=1619047
• Cyber War t160

  https://web.archive.org/web/20120402115209/https://blog.startcom.org/?p=229
• ComodoHacker’s Pastebin t166

  https://pastebin.com/u/ComodoHacker
• September 2011 Security Incident Report t165

  https://web.archive.org/web/20140202142309/https://www.globalsign.com/company/press/121311-security-incident-report.html
• Bug #698753: Entrust SubCA: 512-bit key issuance and other CPS violations; malware in the wild t168

  https://bugzilla.mozilla.org/show_bug.cgi?id=698753
• ich sun on Twitter t167

  https://twitter.com/ichsunx2
• DigiNotar public report version 1 t162

  https://www.rijksoverheid.nl/ministeries/ministerie-van-binnenlandse-zaken-en-koninkrijksrelaties/documenten/rapporten/2011/09/05/diginotar-public-report-version-1
• Is This MITM Attack to Gmail's SSL ? t161

  https://productforums.google.com/forum/#!msg/gmail/3J3r2JqFNTw/oHHZLJeedHMJ
• Striking Back... t164

  https://pastebin.com/1AxH30em
• Black Tulip Update t163

  https://web.archive.org/web/20150906215523/https://www.rijksoverheid.nl/documenten/rapporten/2012/08/13/black-tulip-update
• Response to some comments t159

  https://pastebin.com/GkKUhu35
• Another status update message t158

  https://pastebin.com/85WV10EL
• RE: Web Browsers and Comodo Announce A Successful Certificate Authority Attack, Perhaps From Iran t155

  https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/zgKmHOTIxn8/5NNYcgPNqlgJ
• Detecting Certificate Authority compromises and web browser collusion t154

  https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion
• New hack on Comodo reseller exposes private data t157

  https://www.theregister.com/2011/05/24/comodo_reseller_hacked/
• A message from Comodo Hacker t156

  https://pastebin.com/74KXCaEZ
• This morning's MD5 attack - resolved t151

  https://web.archive.org/web/20110806064206/http://www.symantec.com/connect/blogs/mornings-md5-attack-resolved
• Verisign and responsible disclosure t150

  http://www.phreedom.org/blog/2009/verisign-and-responsible-disclosure/
• Bug 642395: Deal with bogus certs issued by Comodo partner t153

  https://bugzilla.mozilla.org/show_bug.cgi?id=642395
• Comodo Report of Incident t152

  https://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html
• What is Flame? t148

  https://web.archive.org/web/20121010063428/http://www.kaspersky.com/flame
• Colliding X.509 Certificates for Different Identities t147

  https://www.win.tue.nl/hashclash/TargetCollidingCertificates/
• CWI cryptanalyst discovers new cryptographic attack variant in Flame spy malware t149

  https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware
• Further improving digital certificate security t180

  https://googleonlinesecurity.blogspot.co.uk/2013/12/further-improving-digital-certificate.html
• Improperly Issued Digital Certificates Could Allow Spoofing t182

  https://technet.microsoft.com/library/security/2916652
• Revoking Trust in one ANSSI Certificate t181

  https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/
• hey @Gogo, why are you issuing *.google.com certificates on your planes? t188

  https://twitter.com/__apf__/status/551083956326920192
• A survey and analysis of TLS interception mechanisms and motivations t187

  https://arxiv.org/abs/2010.16388
• Our Technology Statement from Gogo regarding our streaming video policy t189

  https://web.archive.org/web/20150404014855/http://concourse.gogoair.com/technology/statement-gogo-regarding-streaming-video-policy
• Revoking Trust in one ANSSI Certificate t184

  https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/uCZi6Ua-uPA
• Revocation of an IGC/A branch t183

  https://web.archive.org/web/20141202143116/http://www.ssi.gouv.fr/en/the-anssi/events/revocation-of-an-igc-a-branch-808.html
• Maintaining digital certificate security t186

  https://googleonlinesecurity.blogspot.co.uk/2014/07/maintaining-digital-certificate-security.html
• Announcing Version 2.1 of Mozilla CA Certificate Policy t185

  https://blog.mozilla.org/security/2013/02/15/announcing-version-2-1-of-mozilla-ca-certificate-policy/
• DigiCert, Inc. Of No Relation to Recent "Digi" Insecure Certificates t171

  https://www.digicert.com/news/2011-11-1-breaches-and-similar-names.htm
• Revoking Trust in DigiCert Sdn. Bhd Intermediate Certificate Authority t170

  https://blog.mozilla.org/security/2011/11/03/revoking-trust-in-digicert-sdn-bhd-intermediate-certificate-authority/
• Counter-cryptanalysis t177

  https://marc-stevens.nl/research/papers/C13-S.pdf
• Microsoft Sub-CA used in malware signing t176

  https://lists.randombit.net/pipermail/cryptography/2012-June/002992.html
• Public Announcements t179

  https://web.archive.org/web/20130926134541/http://turktrust.com.tr/en/kamuoyu-aciklamasi-en.2.html
• Enhancing digital certificate security t178

  https://googleonlinesecurity.blogspot.co.uk/2013/01/enhancing-digital-certificate-security.html
• Flame / Skywiper / Flamer reports t173

  https://web.archive.org/web/20120820145510/http://www.crysys.hu/targeted-attacks.html
• Identification of a New Targeted Cyber-Attack t172

  https://web.archive.org/web/20140331222159/http://www.certcc.ir/index.php?name=news&file=article&sid=1894
• Snack Attack: Analyzing Flame’s Replication Pattern t175

  https://threatpost.com/snack-attack-analyzing-flames-replication-pattern-060712/76660/
• Analyzing the MD5 collision in Flame t174

  https://blog.trailofbits.com/2012/06/11/analyzing-the-md5-collision-in-flame/
• Entrust Bulletin on Certificates Issued with Weak 512-bit RSA Keys by Digicert Malaysia t169

  https://web.archive.org/web/20150629012844/http://www.entrust.net/advisories/malaysia.htm
• #Superfish Round-Up t191

  https://noncombatant.org/2015/02/21/superfish-round-up/
• Gogo no longer issuing fake Google SSL certificates t190

  https://www.runwaygirlnetwork.com/2015/01/13/gogo-no-longer-issuing-fake-google-ssl-certificates/
• Komodia/Superfish SSL Validation is broken t193

  https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/
• Extracting the SuperFish certificate t192

  https://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.YT0VGS1Q0gg
• The Risks of SSL Inspection t199

  https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
• Comodo ships Adware Privdog worse than Superfish t198

  https://blog.hboeck.de/archives/865-Software-Privdog-worse-than-Superfish.html
• MSRT March: Superfish cleanup t195

  https://web.archive.org/web/20160409040200/https://blogs.technet.microsoft.com/mmpc/2015/03/09/msrt-march-superfish-cleanup/
• Windows SSL Interception Gone Wild t194

  https://web.archive.org/web/20150223152047/https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339
• Check for bad certs from Komodia / Superfish t197

  https://superfish.tlsfun.de/
• Superfish, Komodia, PrivDog vulnerability test t196

  https://filippo.io/Badfish/

6. HTTP and Browser Issues

• A study of what really breaks SSL t300

  https://blog.ivanristic.com/2011/05/a-study-of-what-really-breaks-ssl.html
• RFC 6960: X.509 Internet PKI Online Certificate Status Protocol t320

  https://tools.ietf.org/html/rfc6960
• Revocation doesn't work t322

  https://www.imperialviolet.org/2011/03/18/revocation.html
• RFC 5019: The Lightweight OCSP Profile for High-Volume Environments t321

  https://tools.ietf.org/html/rfc5019
• Sub-Prime PKI: Attacking Extended Validation SSL t317

  https://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA09-Zusman-AttackExtSSL-SLIDES.pdf
• Beware of Finer-Grained Origins t316

  https://seclab.stanford.edu/websec/origins/fgo.pdf
• How certificate revocation (doesn’t) work in practice t319

  https://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-doesnt-work-in-practice.html
• NIST Workshop: Improving Trust in the Online Marketplace t318

  https://csrc.nist.gov/groups/ST/ca-workshop-2013/presentations/Koski_ca-workshop2013.pdf
• Upcoming Change to Chrome's Identity Indicators t313

  https://groups.google.com/a/chromium.org/g/security-dev/c/h1bTcoTpfeI
• Minutes for CA/Browser Forum F2F Meeting 44 t312

  https://cabforum.org/2018/06/06/minutes-for-ca-browser-forum-f2f-meeting-44-london-6-7-june-2018/#Apple-Root-Program-Update
• BIMI t315

  https://bimigroup.org
• Improved Security and Privacy Indicators in Firefox 70 t314

  https://blog.mozilla.org/security/2019/10/15/improved-security-and-privacy-indicators-in-firefox-70/
• On Comodo CA’s Recent Revocation of an SSL Certificate for Kentucky-based Stripe, Inc. t311

  https://web.archive.org/web/20180503161444/https://www.comodoca.com/en-us/about/blog/on-comodo-ca%E2%80%99s-recent-revocation-of-an-ssl-certifi/
• Extended Validation Is Broken t310

  https://web.archive.org/web/20171211181630/https://stripe.ian.sh/
• Firefox and Chrome start warning about insecure login forms t306

  https://www.feistyduck.com/bulletproof-tls-newsletter/issue_24_firefox_and_chrome_start_warning_about_insecure_login_forms
• Percentage of Web Pages Loaded by Firefox Using HTTPS t305

  https://letsencrypt.org/stats/
• Deprecating Powerful Features on Insecure Origins t308

  https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-powerful-features-on-insecure-origins
• A milestone for Chrome security: marking HTTP as “not secure” t307

  https://www.blog.google/products/chrome/milestone-chrome-security-marking-http-not-secure/
• UpgradeInsecureRequestsEnabled t302

  https://chromestatus.com/metrics/feature/timeline/popularity/740
• A Dangerous Mix: Large-scale analysis of mixed-content websites t301

  https://www.securitee.org/files/mixedinc_isc2013.pdf
• Google Transparency Report: HTTPS t304

  https://www.google.com/transparencyreport/https/metrics/
• Marking HTTP As Non-Secure t303

  https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure
• First part of phishing with EV t309

  https://web.archive.org/web/20171212030739/https://0.me.uk/ev-phishing/
• Is the Web Ready for OCSP Must-Staple? t339

  https://www.ccs.neu.edu/home/amislove/publications/OCSP-IMC.pdf
• RFC 7633: X.509v3 TLS Feature Extension t338

  https://datatracker.ietf.org/doc/rfc7633/
• Sane time t335

  https://www.chromium.org/developers/design-documents/sane-time
• Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate Errors t334

  https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46359.pdf
• High-reliability OCSP stapling and why it matters t337

  https://blog.cloudflare.com/high-reliability-ocsp-stapling/
• RFC 6066: TLS Extensions: Extension Definitions t336

  https://tools.ietf.org/html/rfc6066
• OCSP Uptime t331

  https://uptime.netcraft.com/perf/reports/OCSP
• CRLite: A Scalable System for Pushing All TLS Revocations to All Browsers t330

  https://obj.umiacs.umd.edu/papers_for_stories/crlite_oakland17.pdf
• The Case for Prefetching and Prevalidating TLS Server Certificates t333

  https://crypto.stanford.edu/%7Edabo/pubs/papers/ssl-prefetch.pdf
• Certificate revocation and the performance of OCSP t332

  https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html
• CA:Revocation Plan t328

  https://wiki.mozilla.org/CA:RevocationPlan
• Revoking Intermediate Certificates: Introducing OneCRL t327

  https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
• Introducing CRLite: All of the Web PKI’s revocations, compressed t329

  https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/
• CRL and OCSP behavior of iOS / Security.Framework? t324

  https://stackoverflow.com/questions/5625642/crl-and-ocsp-behavior-of-ios-security-framework
• Defeating OCSP With The Character '3' t323

  https://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatOCSP-PAPER2.pdf
• CRLSets t326

  https://dev.chromium.org/Home/chromium-security/crlsets
• Revocation checking and Chrome's CRL t325

  https://www.imperialviolet.org/2012/02/05/crlsets.html
• Hacking Github with Webkit t265

  https://homakov.blogspot.co.uk/2013/03/hacking-github-with-webkit.html
• Deprecate modification of 'secure' cookies from non-secure origins t264

  https://tools.ietf.org/html/draft-west-leave-secure-cookies-alone-05
• RFC 6797: HTTP Strict Transport Security t267

  https://tools.ietf.org/html/rfc6797
• Understanding Cookie Security t266

  https://kuza55.blogspot.co.uk/2008/02/understanding-cookie-security.html
• Feature: Strict Secure Cookies t261

  https://www.chromestatus.com/feature/4506322921848832
• New Ways I’m Going to Hack Your Web App t260

  https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.452.2038&rep=rep1&type=pdf
• Multiple Browser Cookie Injection Vulnerabilities t263

  https://www.westpoint.ltd.uk/advisories/wp-04-0001.txt
• Feature: Schemeful same-site t262

  https://chromestatus.com/feature/5096179480133632
• Cross-Site Cooking t258

  https://web.archive.org/web/20060603050359/https://www.securityfocus.com/archive/107/423375/30/0/threaded
• Cookies: HTTP State Management Mechanism t257

  https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/
• Cookie forcing t259

  https://scarybeastsecurity.blogspot.co.uk/2008/11/cookie-forcing.html
• HTTPS Cookie Stealing t254

  https://fscked.org/talks/ActiveHTTPSCookieStealing.pdf
• Active Gmail "Sidejacking" - https is NOT ENOUGH t253

  https://seclists.org/bugtraq/2007/Aug/70
• RFC 6265: HTTP State Management Mechanism t256

  https://tools.ietf.org/html/rfc6265
• CookieMonster t255

  https://fscked.org/projects/cookiemonster
• BlackSheep t250

  https://www.zscaler.com/tools/blacksheep
• Idiocy t252

  https://jonty.co.uk/idiocy
• FireShepherd t251

  https://notendur.hi.is/gas15/FireShepherd/
• Firesheep announcement t249

  https://codebutler.com/firesheep/
• SideJacking with Hamster t248

  https://blog.erratasec.com/2007/08/sidejacking-with-hamster_05.html
• Exploring User Reactions to New Browser Cues for Extended Validation Certificates t281

  https://www.ccsl.carleton.ca/paper-archive/sobey-esorics-08.pdf
• A Week to Remember: The Impact of Browser Warning Storage Policies t280

  https://www.usenix.org/conference/soups2016/technical-sessions/presentation/weinberger
• Protecting users from insecure downloads in Google Chrome t287

  https://blog.chromium.org/2020/02/protecting-users-from-insecure.html
• Mobile Users Three Times More Vulnerable to Phishing Attacks t286

  https://securityintelligence.com/mobile-users-3-times-more-vulnerable-to-phishing-attacks/
• Google Analytics Usage Statistics t289

  https://trends.builtwith.com/analytics/Google-Analytics
• Microsoft Edge and mixed content downloads t288

  https://docs.microsoft.com/en-us/deployedge/edge-learnmore-mixed-content-downloads
• The Web's Identity Crisis: Understanding the Effectiveness of Website Identity Indicators t283

  https://www.usenix.org/conference/usenixsecurity19/presentation/thompson
• An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks t282

  https://www.adambarth.com/papers/2007/jackson-simon-tan-barth.pdf
• Measuring SSL Indicators on Mobile Browsers: Extended Life, or End of the Road? t285

  https://www.cise.ufl.edu/~traynor/papers/amrutkar-isc12.pdf
• Web Security Context: User Interface Guidelines t284

  https://www.w3.org/TR/wsc-ui/
• Experimenting At Scale With Google Chrome’s SSL Warning t279

  https://www.robreeder.com/pubs/sslExperimentCHI2014.pdf
• sslsniff t270

  https://github.com/moxie0/sslsniff
• Bug 460374: All certificates show not trusted - get error code (MITM in-the-wild) t276

  https://bugzilla.mozilla.org/show_bug.cgi?id=460374
• TODO: Break Internet t275

  https://blog.johnath.com/2007/10/11/todo-break-internet/
• Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness t278

  https://www.usenix.org/conference/usenixsecurity13/technical-sessions/presentation/akhawe
• On the Challenges in Usable Security Lab Studies: Lessons Learned from Replicating a Study on SSL Warnings t277

  https://cups.cs.cmu.edu/soups/2011/proceedings/a3_Sotirakopoulos.pdf
• Where the Wild Warnings Are: Root Causes of Chrome Certificate Errors t272

  https://research.google/pubs/pub46359/
• SSLsplit - transparent and scalable SSL/TLS interception t271

  https://www.roe.ch/SSLsplit
• Bug 431827: Exceptions for invalid SSL certificates are too easy to add t274

  https://bugzilla.mozilla.org/show_bug.cgi?id=431827
• Here’s My Cert, So Trust Me, Maybe? Understanding TLS Errors on the Web t273

  https://www.icsi.berkeley.edu/pubs/networking/ICSI_heresmycert13.pdf
• sslstrip t269

  https://github.com/moxie0/sslstrip
• Cookie Prefixes t268

  https://datatracker.ietf.org/doc/draft-ietf-httpbis-cookie-prefixes/
• Use AdSense on your HTTPS sites t290

  https://adsense.blogspot.co.uk/2013/09/use-adsense-on-your-https-sites13.html
• Trying to end mixed scripting vulnerabilities t292

  https://googleonlinesecurity.blogspot.co.uk/2011/06/trying-to-end-mixed-scripting.html
• Mixed Content Level 2 Editor’s Draft t291

  https://w3c.github.io/webappsec-mixed-content/
• SSL, TLS and a Little ActiveX: How IE7 Strikes a Balance Between Security and Compatibility t298

  https://blogs.msdn.microsoft.com/ie/2006/10/18/ssl-tls-and-a-little-activex-how-ie7-strikes-a-balance-between-security-and-compatibility/
• Mixed Content Blocking Enabled in Firefox 23! t297

  https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/
• Internet Explorer 9 Security Part 4: Protecting Consumers from Malicious Mixed Content t299

  https://blogs.msdn.microsoft.com/ie/2011/06/23/internet-explorer-9-security-part-4-protecting-consumers-from-malicious-mixed-content/
• PSA: Tightening Blink's mixed content behavior t294

  https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/Uxzvrqb6IeU/9FAie9Py4cIJ
• Ending mixed scripting vulnerabilities t293

  https://blog.chromium.org/2012/08/ending-mixed-scripting-vulnerabilities.html
• Bug 62178: Implement mechanism to prevent sending insecure requests from a secure context t296

  https://bugzilla.mozilla.org/show_bug.cgi?id=62178
• No More Mixed Messages About HTTPS t295

  https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

7. Implementation Issues

• Virtual Host Confusion: Weaknesses and Exploits t412

  https://www.blackhat.com/docs/us-14/materials/us-14-Delignat-The-BEAST-Wins-Again-Why-TLS-Keeps-Failing-To-Protect-HTTP-wp.pdf
• MitM DNS Rebinding SSL/TLS Wildcards and XSS t411

  https://web.archive.org/web/20150315042723/http://ha.ckers.org/blog/20100822/mitm-dns-rebinding-ssltls-wildcards-and-xss/
• ALPACA Attack t413

  https://www.usenix.org/conference/usenixsecurity21/presentation/brinkmann
• Triple Handshakes and Cookie Cutters t410

  https://mitls.org/pages/attacks/3SHAKE
• TLS Symmetric Crypto t405

  https://www.imperialviolet.org/2014/02/27/tlssymmetriccrypto.html
• RFC 7507: TLS Fallback SCSV for Preventing Protocol Downgrade Attacks t404

  https://datatracker.ietf.org/doc/rfc7507/
• Internet Explorer should send TLS_FALLBACK_SCSV t407

  https://web.archive.org/web/20150912211710/https://connect.microsoft.com/IE/feedback/details/1002874/internet-explorer-should-send-tls-fallback-scsv
• The POODLE Attack and the End of SSL 3.0 t406

  https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
• SCSVs and SSLv3 fallback t401

  https://www.ietf.org/mail-archive/web/tls/current/msg09450.html
• Managing and removing automatic version rollback in TLS Clients t400

  https://datatracker.ietf.org/doc/draft-pettersen-tls-version-rollback-removal/
• An SCSV to stop TLS fallback. t403

  https://www.ietf.org/mail-archive/web/tls/current/msg10676.html
• TLS Fallback SCSV for Preventing Protocol Downgrade Attacks t402

  https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-02
• Truncating TLS Connections to Violate Beliefs in Web Applications t409

  https://www.usenix.org/system/files/conference/woot13/woot13-smyth.pdf
• RFC 8701: Applying GREASE to TLS Extensibility t408

  https://datatracker.ietf.org/doc/draft-ietf-tls-grease/
• Incorrect checks for malformed signatures t342

  https://www.openssl.org/news/secadv/20090107.txt
• Analysis of vulnerability GNUTLS-SA-2008-3 CVE-2008-4989 t341

  http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217
• About the security content of iOS 7.0.6 t344

  https://support.apple.com/en-gb/HT202934
• TWSL2011-007: iOS SSL Implementation Does Not Validate Certificate Chain t343

  https://seclists.org/fulldisclosure/2011/Jul/315
• Certificate Validation Flaw Could Enable Identity Spoofing t340

  https://technet.microsoft.com/library/security/ms02-050
• Debian and OpenSSL: The Aftermath t364

  https://www.links.org/?p=328
• Vendors Are Bad For Security t363

  https://www.links.org/?p=327
• RNG Bug May Result in Weak Cryptographic Keys t366

  https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2013-003.txt.asc
• Microsoft confirms that XP contains random number generator bug t365

  https://web.archive.org/web/20080622122347/http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9048438
• unssl.c t360

  https://web.archive.org/web/20101028073625/http://www.mavi1.org/web_security/cryptography/General/unssl.c
• Working exploit for Debian generated SSH Keys t362

  https://seclists.org/fulldisclosure/2008/May/410
• DSA-1571-1: openssl -- predictable random number generator t361

  https://www.debian.org/security/2008/dsa-1571
• More Tricks For Defeating SSL In Practice t357

  https://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf
• PKI Layer Cake: New Collision Attacks Against the Global X.509 Infrastructure t356

  https://securewww.esat.kuleuven.be/cosic/publications/article-1432.pdf
• Randomness and the Netscape Browser t359

  https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.html
• Why TLS is better without STARTTLS t358

  https://nostarttls.secvuln.info
• Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations t353

  https://www.cs.utexas.edu/%7Eshmat/shmat_oak14.pdf
• Add openssl_altchainsforgery_mitm_proxy.rb t352

  https://github.com/rapid7/metasploit-framework/pull/5735
• The most dangerous code in the world: validating SSL certificates in non-browser software t355

  https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
• Frankencert t354

  https://github.com/sumanj/frankencert
• Add test for CVE-2015-1793 t351

  https://github.com/openssl/openssl/commit/593e9c638c58e1a510c519db0d024527113330f3
• Alternative chains certificate forgery t350

  https://openssl.org/news/secadv/20150709.txt
• Early ChangeCipherSpec Attack t349

  https://www.imperialviolet.org/2014/06/05/earlyccs.html
• Advisories t346

  https://gnutls.org/security.html
• Apple's SSL/TLS bug t345

  https://www.imperialviolet.org/2014/02/22/applebug.html
• OpenSSL Security Advisory CVE-2014-0224 t348

  https://www.openssl.org/news/secadv/20140605.txt
• Dissecting the GnuTLS Bug t347

  https://zeek.org/2014/03/06/dissecting-the-gnutls-bug/
• Pacemaker t380

  https://github.com/Lekensteyn/pacemaker
• Security Advisory 3046015: Vulnerability in Schannel Could Allow Security Feature Bypass t386

  https://docs.microsoft.com/en-us/security-updates/securityadvisories/2015/3046015
• About Security Update 2015-002 t385

  https://support.apple.com/en-us/HT204413
• GitHub Gist: Temporary RSA 512 Bit Keylife for FREAK attack t388

  https://gist.github.com/ValdikSS/f4ba45198fe69c349e9c
• About the security content of iOS 8.2 t387

  https://support.apple.com/en-us/HT204423
• Attack of the week: FREAK (or 'factoring the NSA for fun and profit') t382

  https://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html
• Ticketbleed t381

  https://filippo.io/Ticketbleed/
• Stop the presses: HTTPS-crippling “FREAK” bug affects Windows after all t384

  https://arstechnica.com/security/2015/03/stop-the-presses-https-crippling-freak-bug-affects-windows-after-all/
• HTTPS-crippling FREAK exploit affects thousands of Android and iOS apps t383

  https://arstechnica.com/security/2015/03/https-crippling-freak-exploit-hits-thousands-of-android-and-ios-apps/
• Keys left unchanged in many Heartbleed replacement certificates! t379

  https://news.netcraft.com/archives/2014/05/09/keys-left-unchanged-in-many-heartbleed-replacement-certificates.html
• Heartbleed hacks hit Mumsnet and Canada’s tax agency t378

  https://www.bbc.co.uk/news/technology-27028101
• The Results of the CloudFlare Challenge t375

  https://blog.cloudflare.com/the-results-of-the-cloudflare-challenge/
• 300k servers vulnerable to Heartbleed one month later t374

  https://blog.erratasec.com/2014/05/300k-servers-vulnerable-to-heartbleed.html#.YT3b8i1Q1Kw
• Attackers Exploit the Heartbleed OpenSSL Vulnerability to Circumvent Multi-factor Authentication on VPNs t377

  https://web.archive.org/web/20140418233924/https://www.mandiant.com/blog/attackers-exploit-heartbleed-openssl-vulnerability-circumvent-multifactor-authentication-vpns/
• Searching for The Prime Suspect: How Heartbleed Leaked Private Keys t376

  https://blog.cloudflare.com/searching-for-the-prime-suspect-how-heartbleed-leaked-private-keys/
• OpenSSL Project Roadmap t371

  https://web.archive.org/web/20150815130657/http://openssl.org/about/roadmap.html
• Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL t370

  https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
• Half a million widely trusted websites vulnerable to Heartbleed bug t373

  https://news.netcraft.com/archives/2014/04/08/half-a-million-widely-trusted-websites-vulnerable-to-heartbleed-bug.html
• LibreSSL t372

  https://www.libressl.org
• LittleBlackBox t368

  https://code.google.com/archive/p/littleblackbox
• Widespread Weak Keys in Network Devices t367

  https://factorable.net/
• You're Doing IoT RNG t369

  https://labs.bishopfox.com/tech-blog/youre-doing-iot-rng
• The Logjam Attack t391

  https://weakdh.org
• A Messy State of the Union: Taming the Composite State Machines of TLS t390

  https://www.ieee-security.org/TC/SP2015/papers-archived/6949a535.pdf
• One approach to rollback protection t397

  https://www.ietf.org/mail-archive/web/tls/current/msg08099.html
• Standards work update t396

  https://web.archive.org/web/20140301045454/http://my.opera.com/yngve/blog/2012/11/02/standards-work-update
• Fwd: New Version Notification for draft-pettersen-tls-version-rollback-removal-00.txt t399

  https://www.ietf.org/mail-archive/web/tls/current/msg08889.html
• Cipher suite values to indicate TLS capability t398

  https://www.ietf.org/mail-archive/web/tls/current/msg08861.html
• RFC 6101: The SSL Protocol Version 3.0, Section E.2. t393

  https://tools.ietf.org/html/rfc6101#appendix-E.2
• Prying Eyes: Inside the NSA's War on Internet Security t392

  https://web.archive.org/web/20141228192621/http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html
• Bug #450280: PSM sometimes falls back from TLS to SSL3 when holding F5 (which causes SNI to be disabled) t395

  https://bugzilla.mozilla.org/show_bug.cgi?id=450280
• RFC 3546: TLS Extensions t394

  https://www.ietf.org/rfc/rfc3546.txt
• miTLS t389

  https://www.mitls.org

8. Protocol Attacks

• Extended Random t510

  https://projectbullrun.org/dual-ec/ext-rand.html
• On the Possibility of a Back Door in the NIST SP800-90 Dual Ec Prng t504

  https://rump2007.cr.yp.to/15-shumow.pdf
• Revealed: how US and UK spy agencies defeat internet privacy and security t503

  https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
• Exclusive: Secret contract tied NSA and security industry pioneer t506

  https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220
• SUPPLEMENTAL ITL BULLETIN FOR SEPTEMBER 2013 t505

  https://csrc.nist.gov/csrc/media/publications/shared/documents/itl-bulletin/itlbul2013-09-supplemental.pdf
• robot-detect t500

  https://github.com/robotattackorg/robot-detect
• Secret Documents Reveal N.S.A. Campaign Against Encryption t502

  https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
• Raccoon Attack t501

  https://raccoon-attack.com
• Juniper Breach Mystery Starts to Clear With New Details on Hackers and U.S. Role t508

  https://www.bloomberg.com/news/features/2021-09-02/juniper-mystery-attacks-traced-to-pentagon-role-and-chinese-hackers
•  t507

  https://dl.acm.org/doi/10.1145/2976749.2978395
• On the Practical Exploitability of Dual EC in TLS Implementations t509

  http://dualec.org/
• RFC 5746: TLS Renegotiation Indication Extension t421

  https://tools.ietf.org/html/rfc5746
• My take on the SSL MITM Attacks – part 3 – the FTPS attacks t420

  https://blogs.msmvps.com/alunj/2009/11/18/my-take-on-the-ssl-mitm-attacks-part-3-the-ftps-attacks/
• TLS/SSLv3 renegotiation vulnerability explained t416

  http://www.g-sec.lu/tools.html
• Renegotiating TLS t415

  https://ww1.prweb.com/prfiles/2009/11/05/104435/RenegotiatingTLS.pdf
• Generalization of the TLS Renegotiation Flaw Using HTTP 300 Redirection to Effect Cryptographic Downgrade Attacks t418

  https://www.leviathansecurity.com/white-papers/tls-and-ssl-man-in-the-middle-vulnerability/
• TLS renegotiation vulnerability: definitely not a full blown MITM, yet more than just a simple CSRF t417

  http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html
• MITM attack on delayed TLS-client auth through renegotiation t414

  https://www.ietf.org/mail-archive/web/tls/current/msg03928.html
• Redirecting and modifying SMTP mail with TLS session renegotiation attacks t419

  http://www.postfix.org/wip.html
• Blockwise-Adaptive Attackers: Revisiting the (In)Security of Some Provably Secure Encryption Modes: CBC, GEM, IACBC t441

  https://link.springer.com/content/pdf/10.1007%2F3-540-45708-9_2.pdf
• Breaking and Provably Repairing the SSH Authenticated Encryption Scheme: A Case Study of the Encode-then-Encrypt-and-MAC Paradigm t440

  https://eprint.iacr.org/2002/078.pdf
• A Challenging but Feasible Blockwise-Adaptive Chosen-Plaintext Attack on SSL t443

  https://eprint.iacr.org/2006/136.pdf
• Vulnerability of SSL to Chosen-Plaintext Attack t442

  https://eprint.iacr.org/2004/111
• An Attack Against SSH2 Protocol t438

  http://www.weidai.com/ssh2-attack.txt
• Problems with Proposed IP Cryptography t437

  https://web.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipsec-comments-00.txt
• Re: an attack against SSH2 protocol t439

  https://www.mail-archive.com/openssl-dev@openssl.org/msg10664.html
• Bug #2635: 1/n-1 record splitting technique for CVE-2011-3389 t434

  https://marc.info/?l=openssl-dev&m=132008027923646&w=2
• NSS 3.13 Release Notes t433

  https://groups.google.com/forum/#!msg/mozilla.dev.tech.crypto/KMn9LWX3vVU/-XKglCaGHLcJ
• Oracle Java SE Critical Patch Update Advisory - October 2011 t436

  https://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
• Opera 11.60 for Windows changelog t435

  https://web.archive.org/web/20121220094552/http://www.opera.com/docs/changelogs/windows/1160/
• Bug #702111: Servers intolerant to 1/n-1 record splitting. "The connection was reset" t430

  https://bugzilla.mozilla.org/show_bug.cgi?id=702111
• Microsoft Knowledge Base Article 2643584 t432

  https://support.microsoft.com/en-us/kb/2643584
• Microsoft Security Bulletin MS12-006 t431

  https://technet.microsoft.com/library/security/ms12-006
• Bug #665814, comment #59: Rizzo/Duong chosen plaintext attack (BEAST) on SSL/TLS 1.0 t427

  https://bugzilla.mozilla.org/show_bug.cgi?id=665814#c59
• The pitfalls of allowing file uploads on your website t426

  https://labs.detectify.com/post/86302927946/the-lesser-known-pitfalls-of-allowing-file-uploads
• Apple enabled BEAST mitigations in OS X 10.9 Mavericks t429

  https://blog.ivanristic.com/2013/10/apple-enabled-beast-mitigations-in-mavericks.html
• BEAST followup t428

  https://www.imperialviolet.org/2012/01/15/beastfollowup.html
• Re: Call for acceptance of draft-moeller-tls-downgrade-scsv t423

  https://www.ietf.org/mail-archive/web/tls/current/msg11270.html
• Secure browsing like it's 1995 t422

  https://web.archive.org/web/20140302021900/http://my.opera.com/securitygroup/blog/2011/03/17/secure-browsing-like-its-1995
• BEAST t425

  https://vnhacker.blogspot.co.uk/2011/09/beast.html
• Here come the ⊕ Ninjas t424

  https://nerdoholic.org/uploads/dergln/beast_part2/ssl_jun21.pdf
• Lucky Thirteen: Breaking the TLS and DTLS Record Protocols t463

  http://www.isg.rhul.ac.uk/tls/Lucky13.html
• CTX: Eliminating BREACH with Context Hiding t462

  https://www.blackhat.com/eu-16/briefings.html#ctx-eliminating-breach-with-context-hiding
• Padding oracle attack simulation t465

  https://erlend.oftedal.no/blog/poet/
• Automated Padding Oracle Attacks with PadBuster t464

  https://blog.gdssecurity.com/labs/2010/9/14/automated-padding-oracle-attacks-with-padbuster.html
• BREACH mitigation t461

  https://community.qualys.com/message/20404
• breach attack t460

  https://mail-archives.apache.org/mod_mbox/httpd-dev/201308.mbox/%3CCAMDeyhwCYYQMK+WTfvge7y20AqEB1=kqMHgqKYhr3kBWkZyYzA@mail.gmail.com%3E
• HEIST t459

  https://www.blackhat.com/docs/us-16/materials/us-16-VanGoethem-HEIST-HTTP-Encrypted-Information-Can-Be-Stolen-Through-TCP-Windows.pdf
• BREACH web site t456

  http://breachattack.com/
• BREACH: Reviving the CRIME Attack t455

  http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf
• Rupture: A compression side-channel attack framework t458

  https://web.archive.org/web/20170710054644/https://ruptureit.com/
• BREACH repository t457

  https://github.com/nealharris/BREACH
• It's not a crime to build a CRIME t452

  https://gist.github.com/koto/3696912
• CRIME - How to beat the BEAST successor? t451

  https://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor
• A Perfect CRIME? TIME Will Tell t454

  https://www.blackhat.com/eu-13/briefings.html#Beery
• Crack in Internet’s foundation of trust allows HTTPS session hijacking t453

  https://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/
• New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions t450

  https://threatpost.com/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512/76973/
• The CRIME attack t449

  http://netifera.com/research/crime/CRIME_ekoparty2012.pdf
• Compression contexts and privacy considerations t448

  https://groups.google.com/forum/#!msg/spdy-dev/B_ulCnBjSug/rcU-SIFtTKoJ
• Compression and Information Leakage of Plaintext t445

  https://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
•  t444

  https://src.chromium.org/viewvc/chrome/trunk/src/net/third_party/nss/patches/cbcrandomiv.patch?pathrev=97269
• Uncovering Spoken Phrases in Encrypted Voice over IP Conversations t447

  https://www.cs.unc.edu/%7Efabian/papers/tissec2010.pdf
• Language identification of encrypted VoIP traffic: Alejandra y Roberto or Alice and Bob? t446

  https://web.archive.org/web/20080221204234/http://www.cs.jhu.edu/~cwright/voip-vbr.pdf
• This POODLE bites: exploiting the SSL 3.0 fallback t485

  https://googleonlinesecurity.blogspot.co.uk/2014/10/this-poodle-bites-exploiting-ssl-30.html
• TLS Resumption Indication Extension t484

  https://datatracker.ietf.org/doc/draft-bhargavan-tls-resumption-indication/
• There are more POODLEs in the forest t487

  https://yngve.vivaldi.net/there-are-more-poodles-in-the-forest/
• Poodle Bites TLS t486

  https://blog.ivanristic.com/2014/12/poodle-bites-tls.html
• RC4 No More t481

  https://www.rc4nomore.com/
• Attacking SSL when using RC4 t480

  https://web.archive.org/web/20150715235918/http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf
• RFC 7627: TLS Session Hash and Extended Master Secret Extension t483

  https://datatracker.ietf.org/doc/rfc7627/
• Unknown key-share attacks on the station-to-station (STS) protocol t482

  https://books.google.co.uk/books?id=cyHE4f0ukbYC&pg=PA154
• Statistical Analysis of the Alleged RC4 Keystream Generator t478

  https://link.springer.com/content/pdf/10.1007/3-540-44706-7_2.pdf
• On the Security of RC4 in TLS and WPA t477

  http://www.isg.rhul.ac.uk/tls/
• Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS t479

  http://www.isg.rhul.ac.uk/tls/RC4mustdie.html
• The ICSI Certificate Notary t474

  https://notary.icsi.berkeley.edu/#connection-cipher-details
• What's the deal with RC4? t473

  https://blog.cryptographyengineering.com/2011/12/whats-deal-with-rc4.html
• A Practical Attack on Broadcast RC4 t476

  https://web.archive.org/web/20131113041030/http://saluc.engr.uconn.edu/refs/stream_cipher/mantin01attackRC4.pdf
• RFC 7465: Prohibiting RC4 Cipher Suites t475

  https://tools.ietf.org/html/rfc7465
• RFC 7366: Encrypt-then-MAC for TLS and DTLS t470

  https://tools.ietf.org/html/rfc7366
• RSA Security Response to Weaknesses in Key Scheduling Algorithm of RC4 t472

  https://web.archive.org/web/20131001024142/http://www.emc.com/emc-plus/rsa-labs/historical/rsa-security-response-weaknesses-algorithm-rc4.htm
• Weaknesses in the Key Scheduling Algorithm of RC4 t471

  http://merlot.usc.edu/cs531-s11/papers/Fluhrer01a.pdf
• Password Interception in a SSL/TLS Channel t467

  https://www.iacr.org/cryptodb/archive/2003/CRYPTO/1069/1069.pdf
• Security Flaws Induced by CBC Padding - Applications to SSL, IPSEC, WTLS... t466

  https://www.iacr.org/archive/eurocrypt2002/23320530/cbc02_e02d.pdf
• Plaintext-Recovery Attacks Against Datagram TLS t469

  https://www.isg.rhul.ac.uk/~kp/dtls.pdf
• Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures t468

  https://www.openssl.org/%7Ebodo/tls-cbc.txt
• RFC 8017: PKCS #1: RSA Cryptography Specifications Version 2.2 t499

  https://tools.ietf.org/html/rfc8017
• RFC 7568: Deprecating Secure Sockets Layer Version 3.0 t490

  https://tools.ietf.org/html/rfc7568
• The ROBOT Attack t496

  https://robotattack.org
• Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1 t495

  http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
• PKCS #1: RSA Encryption Version 1.5 t498

  https://tools.ietf.org/html/rfc2313
• The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations t497

  https://www.nccgroup.com/ae/about-us/newsroom-and-events/blogs/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/
• Security Losses from Obsolete and Truncated Transcript Hashes t492

  https://www.mitls.org/pages/attacks/SLOTH
• KCI Attacks against TLS t491

  https://kcitls.org
• Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN t494

  https://sweet32.info/
• The DROWN Attack t493

  https://drownattack.com/
• RFC 7507: TLS Fallback SCSV for Preventing Protocol Downgrade Attacks  t489

  https://tools.ietf.org/html/rfc7507
• Zombie POODLE and GOLDENDOODLE Vulnerabilities t488

  https://blog.qualys.com/product-tech/2019/04/22/zombie-poodle-and-goldendoodle-vulnerabilities

9. Performance

• SSL FalseStart Performance Results t520

  https://blog.chromium.org/2011/05/ssl-falsestart-performance-results.html
• Fast-Track Session Establishment for TLS t515

  https://www.ndss-symposium.org/wp-content/uploads/2017/09/Fast-track-session-establishment-for-TLS.pdf
• TLS Snap Start t514

  https://datatracker.ietf.org/doc/html/draft-agl-tls-snapstart-00
• Building a faster and more secure web with TCP Fast Open, TLS False Start, and TLS 1.3 t517

  https://blogs.windows.com/msedgedev/2016/06/15/building-a-faster-and-more-secure-web-with-tcp-fast-open-tls-false-start-and-tls-1-3/
• RFC 7413: TCP Fast Open t516

  https://datatracker.ietf.org/doc/html/rfc7413
• Marissa Mayer at Web 2.0 t511

  https://glinden.blogspot.co.uk/2006/11/marissa-mayer-at-web-20.html
• Overclocking SSL t513

  https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
• Make Data Useful t512

  https://speed24.ru/docs/StanfordDataMining.2006-11-28.pdf
• Changing HTTPS t519

  https://www.imperialviolet.org/2010/09/05/blacklisting.html
• The Sad Story of TCP Fast Open t518

  https://squeeze.isobar.com/2019/04/11/the-sad-story-of-tcp-fast-open/
• Introducing Zero Round Trip Time Resumption t540

  https://blog.cloudflare.com/introducing-0-rtt/
• High Scalability for SSL and Apache t542

  https://awe.com/mark/talks/apachecon2000.pdf
• ChaCha20 and Poly1305 for TLS t541

  https://www.imperialviolet.org/2013/10/07/chacha20.html
• RFC 8879: TLS Certificate Compression t537

  https://datatracker.ietf.org/doc/html/rfc8879
• An Experimental Study of TLS Forward Secrecy Deployments t536

  https://www.linshunghuang.com/papers/ecc-pfs.pdf
• TLS 1.3 certificate compression with Brotli t539

  https://www.chromestatus.com/feature/5696925844111360
• RFC 7924: TLS Cached Information Extension t538

  https://datatracker.ietf.org/doc/html/rfc7924
• HTTP/3 explained t533

  https://http3-explained.haxx.se
• RFC 8701: Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility t532

  https://datatracker.ietf.org/doc/html/rfc8701
• SSL/TLS & Perfect Forward Secrecy t535

  https://vincent.bernat.ch/en/blog/2011-ssl-perfect-forward-secrecy
• ivanr / ssl-dos t534

  https://github.com/ivanr/ssl-dos
• Experimenting with QUIC t531

  https://blog.chromium.org/2013/06/experimenting-with-quic.html
• SPDY t530

  https://www.chromium.org/spdy/
• RFC 6928: Increasing TCP’s Initial Window t526

  https://tools.ietf.org/html/rfc6928
• RFC 7918: TLS False Start t525

  https://datatracker.ietf.org/doc/html/rfc7918
• Slowloris HTTP DoS t528

  https://web.archive.org/web/20150315054838/http://ha.ckers.org/slowloris/
• Initcwnd settings of major CDN providers t527

  https://www.cdnplanet.com/blog/initcwnd-settings-major-cdn-providers/
• Re-enable TLS False Start t522

  https://bugzilla.mozilla.org/show_bug.cgi?id=942729
• False Start's Failure t521

  https://www.imperialviolet.org/2012/04/11/falsestart.html
• Networking Improvements in IE10 and Windows 8 t524

  https://web.archive.org/web/20131221003722/http://blogs.msdn.com/b/ieinternals/archive/2012/08/01/internet-explorer-10-network-performance-improvements-first-available-pre-resolve-pre-connect-caching.aspx
• sslTransport.c t523

  https://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslTransport.c
• SSL_CTX_set_mode(3) t529

  https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_mode.html
• TLS Client Puzzles Extension t548

  https://datatracker.ietf.org/doc/draft-nygren-tls-client-puzzles/
• sslsqueeze on GitHub t547

  https://github.com/mmgaggle/sslsqueeze
• SSL computational DoS mitigation t544

  https://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
• HTTP2 Expression of Interest t543

  https://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0251.html
• SSL/TLS and Computational DoS t546

  https://web.archive.org/web/20111029201202/http://www.educatedguesswork.org/2011/10/ssltls_and_computational_dos.html
• THC SSL DOS t545

  https://thehackerschoice.wordpress.com/2011/10/24/thc-ssl-dos/

10. HSTS, CSP, and Pinning

• Content Security Policy Level 3 t562

  https://www.w3.org/TR/CSP/
• Content Security Policy t561

  https://web.archive.org/web/20111113230920/http://people.mozilla.org/~bsterne/content-security-policy/
• TrustKit for iOS, macOS, tvOS, and watchOS t564

  https://github.com/datatheorem/TrustKit
• Stop Certificate Pinning t563

  https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning
• Content Restrictions t560

  https://www.gerv.net/security/content-restrictions/
• Privacy-preserving HSTS t559

  https://github.com/whatwg/fetch/issues/920
• The Double-Edged Sword of HSTS Persistence and Privacy t558

  https://www.leviathansecurity.com/blog/the-double-edged-sword-of-hsts-persistence-and-privacy/
• Firefox 4 release notes t555

  https://website-archive.mozilla.org/www.mozilla.org/firefox_releasenotes/en-US/firefox/4.0/releasenotes/
• Stable Channel Update t554

  https://googlechromereleases.blogspot.co.uk/2010/01/stable-channel-update_25.html
• Web specifications support in Opera Presto 2.10 t557

  https://web.archive.org/web/20120614230636/https://www.opera.com/docs/specs/presto2.10/
• HTTP Strict Transport Security comes to Internet Explorer 11 on Windows 8.1 and Windows 7 t556

  https://blogs.windows.com/msedgedev/2015/06/09/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7/
• Breaking Out HSTS (and HPKP) on Firefox, IE/Edge and (possibly) Chrome t551

  https://business.blogthinkbig.com/breaking-out-hsts-and-hpkp-on-firefox/
• Service binding and parameter specification via the DNS t550

  https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https/
• Bypassing HTTP Strict Transport Security t553

  https://www.blackhat.com/docs/eu-14/materials/eu-14-Selvi-Bypassing-HTTP-Strict-Transport-Security-wp.pdf
• Analysis of HSTS Caches of Different Browsers t552

  https://insinuator.net/2021/05/analysis-of-hsts-caches-of-different-browsers/
• ForceHTTPS: Protecting High-Security Web Sites from Network Attacks t549

  https://crypto.stanford.edu/forcehttps/forcehttps.pdf
• RFC 8627: TLS Server Identity Pinning with Tickets t583

  https://datatracker.ietf.org/doc/html/rfc8672
• RFC 9102: TLS DNSSEC Chain Extension t580

  https://datatracker.ietf.org/doc/rfc9102/
• Trust Assertions for Certificate Keys t582

  https://tools.ietf.org/html/draft-perrin-tls-tack-02
• RFC 7218: Adding Acronyms to Simplify Conversations about DANE t581

  https://tools.ietf.org/html/rfc7218
• Fixing HPKP with Certificate Constraints t577

  https://blog.qualys.com/product-tech/2017/09/19/fixing-hpkp-with-certificate-constraints
• Fixing HPKP with Pin Revocation t576

  https://blog.qualys.com/product-tech/2017/09/05/fixing-hpkp-with-pin-revocation
• DNSSEC authenticated HTTPS in Chrome t579

  https://www.imperialviolet.org/2011/06/16/dnssecchrome.html
• RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA t578

  https://tools.ietf.org/html/rfc6698
• Intent To Deprecate And Remove: Public Key Pinning t573

  https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr7p3rZ8/m/eNMwKPmUBAAJ
• RFC 7469: Public Key Pinning Extension for HTTP t572

  https://datatracker.ietf.org/doc/rfc7469/
• Abusing Bleeding Edge Web Standards for AppSec Glory t575

  https://www.blackhat.com/docs/us-16/materials/us-16-Zadegan-Abusing-Bleeding-Edge-Web-Standards-For-AppSec-Glory.pdf
• Is HTTP Public Key Pinning Dead? t574

  https://blog.qualys.com/product-tech/2016/09/06/is-http-public-key-pinning-dead
• Enterprise Certificate Pinning t571

  https://docs.microsoft.com/en-us/windows/access-protection/enterprise-certificate-pinning
• Public key pinning released in Firefox t570

  https://blog.mozilla.org/security/2014/09/02/public-key-pinning/
• New Man-in-the-Middle attacks leveraging rogue DNS t569

  https://blog.phishlabs.com/new-man-in-the-middle-attacks-leveraging-rogue-dns
• New Chromium security features, June 2011 t566

  https://blog.chromium.org/2011/06/new-chromium-security-features-june.html
• TrustKit for Android t565

  https://github.com/datatheorem/TrustKit-Android
• transport_security_state_static.json t568

  https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json
• Public key pinning t567

  https://www.imperialviolet.org/2011/05/04/pinning.html

12. OpenSSL Command Line

• Win32/Win64 OpenSSL t584

  https://slproweb.com/products/Win32OpenSSL.html
• Compilation and Installation t586

  https://wiki.openssl.org/index.php/Compilation_and_Installation
• Apache 2.4 VS16 Windows Binaries and Modules t585

  https://www.apachelounge.com/download/
• RFC 7919: Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS t595

  https://tools.ietf.org/html/rfc7919
• Speeding up and Strengthening HTTPS Connections for Chrome on Android t594

  https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html
• OpenSSL CA configuration templates t596

  https://github.com/ivanr/bulletproof-tls/tree/master/private-ca
• man page t591

  https://www.openssl.org/docs/manmaster/man3/SSL_CTX_get_security_level.html
• Certificate Transparency in Chrome t590

  https://github.com/chromium/ct-policy/blob/master/ct_policy.md
• man page t593

  https://www.openssl.org/docs/manmaster/man3/SSL_CONF_cmd.html#SUPPORTED-CONFIGURATION-FILE-COMMANDS
• man page t592

  https://www.openssl.org/docs/manmaster/man5/config.html
• Mozilla CA Certificate Store t588

  https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/
• Hardening t587

  https://wiki.debian.org/Hardening
• RFC 2985: PKCS #9: Selected Object Classes and Attribute Types Version 2.0 t589

  https://tools.ietf.org/html/rfc2985

13. Testing TLS with OpenSSL

• New Adventures in DNSSEC and DANE t599

  https://www.netmeister.org/blog/dnssec-dane.html
• testssl.sh t598

  https://testssl.sh
• Hardenize t597

  https://www.hardenize.com
• Bugs in Heartbleed detection scripts t601

  https://web.archive.org/web/20140419035209/https://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbleed-detection-scripts-
• s_client -reconnect Option Is Broken with TLSv1.3 t600

  https://github.com/openssl/openssl/issues/10714