Links: Bulletproof TLS and PKI 2ed

Below are all the links from the book Bulletproof SSL and TLS. We occasionally run through the entire list to check and fix broken entries. As a result, the links here might not be exactly the same as the ones in the earlier digital releases.

1. SSL, TLS, and Cryptography

Photos of an NSA “upgrade” factory show Cisco router getting implant t10

https://arstechnica.com/tech-policy/2014/05/photos-of-an-nsa-upgrade-factory-show-cisco-router-getting-implant/
RFC 7258: Pervasive Monitoring Is an Attack t12

https://tools.ietf.org/html/rfc7258
GCHQ taps fibre-optic cables for secret access to world's communications t11

https://www.theguardian.com/uk/2013/jun/21/gchq-cables-secret-world-communications-nsa
A Syrian Man-in-the-Middle Attack against Facebook t14

https://www.eff.org/deeplinks/2011/05/syrian-man-middle-against-facebook
Transparency Report t13

https://transparencyreport.google.com
Attacking Tor: How the NSA Targets Users' Online Anonymity t15

https://www.schneier.com/essays/archives/2013/10/attacking_tor_how_th.html
Security Standards and Name Changes in the Browser Wars t1

http://tim.dierks.org/2014/05/security-standards-and-name-changes-in.html
la cryptographie militaire t2

https://www.petitcolas.net/kerckhoffs/
RFC 2104: HMAC: Keyed-Hashing for Message Authentication t3

https://tools.ietf.org/html/rfc2104
ECRYPT2 Yearly Report on Algorithms and Keysizes t4

http://www.ecrypt.eu.org/
Cryptographic Key Length Recommendation t5

https://www.keylength.com/
NIST Special Publication 800-57: Recommendation for Key Management—Part 1: General, Revision 5 t6

https://csrc.nist.gov/publications/detail/sp/800-57-part-1/rev-5/final
Universal security; from bits and mips to pools, lakes—and beyond t7

https://eprint.iacr.org/2013/635
The Creepy, Long-Standing Practice of Undersea Cable Tapping t8

https://www.theatlantic.com/international/archive/2013/07/the-creepy-long-standing-practice-of-undersea-cable-tapping/277855/
New Details About NSA’s Collaborative Relationships With America’s Biggest Telecom Companies From Snowden Docs t9

https://web.archive.org/web/20150927143918/http://www.matthewaid.com/post/59765378513/new-details-about-nsas-collaborative

2. TLS 1.3

RFC 8446: The Transport Layer Security Protocol Version 1.3 t16

https://tools.ietf.org/html/rfc8446
IANA: Transport Layer Security (TLS) Extensions t18

https://www.iana.org/assignments/tls-extensiontype-values/tls-extensiontype-values.xhtml
TLS Version Intolerance in SSL Pulse t17

https://blog.qualys.com/product-tech/2016/08/02/tls-version-intolerance-in-ssl-pulse
RFC 8470: Using Early Data in HTTP t19

https://datatracker.ietf.org/doc/html/rfc8470

3. TLS 1.2

Wireshark t21

https://www.wireshark.org/
RFC 5246: The Transport Layer Security Protocol Version 1.2 t20

https://datatracker.ietf.org/doc/html/rfc5246
TLS Working Group mailing list archives t23

http://www.ietf.org/mail-archive/web/tls/current/
TLS Working Group documents t22

https://datatracker.ietf.org/wg/tls/documents/
RFC 5081: Using OpenPGP Keys for TLS Authentication t25

https://datatracker.ietf.org/doc/html/rfc5081
Deprecating gmt_unix_time in TLS t24

https://datatracker.ietf.org/doc/html/draft-mathewson-no-gmtunixtime-00
RFC 3447: RSA Cryptography Specifications Version 2.1 t27

https://tools.ietf.org/html/rfc3447
The Alert attack t26

https://www.mitls.org/pages/attacks/Alert
Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS t29

https://datatracker.ietf.org/doc/draft-ietf-tls-negotiated-ff-dhe/
Public Key Cryptography: Diffie-Hellman Key Exchange t28

https://www.youtube.com/watch?v=3QnD2c4Xovk
RFC 7366: Encrypt-then-MAC for TLS and DTLS t30

https://datatracker.ietf.org/doc/rfc7366/
Tor Protocol Specification t32

https://gitweb.torproject.org/torspec.git/tree/tor-spec.txt
RFC 7905: ChaCha20-Poly1305 Cipher Suites for TLS t31

https://datatracker.ietf.org/doc/rfc7905/
RFC 7685: A TLS ClientHello Padding Extension t34

https://datatracker.ietf.org/doc/rfc7685/
TLS Parameters t33

https://www.iana.org/assignments/tls-parameters/tls-parameters.xhtml
Certificate Transparency t36

https://certificate.transparency.dev
RFC 7301: TLS Application-Layer Protocol Negotiation Extension t35

https://tools.ietf.org/html/rfc7301
FIPS 186-3: Digital Signature Standard t38

https://csrc.nist.gov/publications/fips/fips186-3/fips_186-3.pdf
RFC 4492: ECC Cipher Suites for TLS t37

https://tools.ietf.org/html/rfc4492
RFC 7027: ECC Brainpool Curves for TLS t39

https://tools.ietf.org/html/rfc7027
SafeCurves: choosing safe curves for elliptic-curve cryptography t41

https://safecurves.cr.yp.to
ECC Cipher Suites for TLS 1.2 and Earlier t40

https://datatracker.ietf.org/doc/draft-ietf-tls-rfc4492bis/
Google Technical Note: TLS Next Protocol Negotiation Extension t43

https://web.archive.org/web/20150529234248/https://technotes.googlecode.com/git/nextprotoneg.html
RFC 6520: TLS and DTLS Heartbeat Extension t42

https://tools.ietf.org/html/rfc6520
Some missing context (was: Confirming consensus for ALPN) t45

https://www.ietf.org/mail-archive/web/tls/current/msg09344.html
Next Protocol Negotiation 03 t44

https://www.ietf.org/mail-archive/web/tls/current/msg08678.html
RFC 5077: TLS Session Resumption without Server-Side State t47

https://tools.ietf.org/html/rfc5077
RFC 6066: TLS Extensions: Extension Definitions t46

http://tools.ietf.org/html/rfc6066
Analysis of the SSL 3.0 protocol t49

https://www.schneier.com/cryptography/paperfiles/paper-ssl-revised.pdf
RFC 6961: TLS Multiple Certificate Status Request Extension t48

https://tools.ietf.org/html/rfc6961

4. Public Key Infrastructure

Simple Certificate Enrolment Protocol t100

https://tools.ietf.org/html/rfc8894
Internet X.509 PKI Certificate Management Protocol t102

https://tools.ietf.org/html/rfc4210
Enrollment over Secure Transport t101

https://tools.ietf.org/html/rfc7030
Open Data t122

https://opendata.rapid7.com
zmap t121

https://github.com/zmap/zmap
Web PKI: Closing the Gap between Guidelines and Practices t124

https://www.microsoft.com/en-us/research/publication/web-pki-closing-the-gap-between-guidelines-and-practices/
A novel method in IE11 for dealing with fraudulent digital certificates t123

https://docs.microsoft.com/en-us/archive/blogs/pki/a-novel-method-in-ie11-for-dealing-with-fraudulent-digital-certificates
Analysis of the HTTPS Certificate Ecosystem t120

https://conferences.sigcomm.org/imc/2013/papers/imc257-durumericAemb.pdf
The ICSI SSL Notary: CA Certificates t119

https://notary.icsi.berkeley.edu/trust-tree/
The ICSI Certificate Notary t118

https://notary.icsi.berkeley.edu/
HTTPS Everywhere & the Decentralized SSL Observatory t115

https://www.eff.org/deeplinks/2012/02/https-everywhere-decentralized-ssl-observatory
The EFF SSL Observatory t114

https://www.eff.org/observatory
SSL Pulse t117

https://www.ssllabs.com/ssl-pulse/
The SSL Landscape - A Thorough Analysis of the X.509 PKI Using Active and Passive Measurements t116

https://conferences.sigcomm.org/imc/2011/docs/p427.pdf
The Sovereign Keys Project t111

https://www.eff.org/sovereign-keys
Convergence t110

https://web.archive.org/web/20150527165611/http://convergence.io/
Internet SSL Survey 2010 is here! t113

https://blog.ivanristic.com/2010/07/internet-ssl-survey-2010-is-here.html
Mutually Endorsing CA Infrastructure version 2 t112

https://kuix.de/mecai/
The Security Impact of HTTPS Interception t108

https://jhalderm.com/pub/papers/interception-ndss17.pdf
Bamboozling Certificate Authorities with BGP t107

https://www.usenix.org/conference/usenixsecurity18/presentation/birge-lee
Perspectives Project t109

http://perspectives-project.org
ACME Working Group t104

https://datatracker.ietf.org/wg/acme/about/
Let’s Encrypt t103

https://letsencrypt.org
Clarifying The Trustwave CA Policy Update t106

https://www.trustwave.com/Resources/SpiderLabs-Blog/Clarifying-The-Trustwave-CA-Policy-Update/
RFC 8555: Automatic Certificate Management Environment t105

https://tools.ietf.org/html/rfc8555
Censys t126

https://censys.io
crt.sh t125

https://crt.sh/
The Rise of Certificate Transparency and Its Implications on the Internet Ecosystem t128

https://arxiv.org/pdf/1809.08325.pdf
Tracking Certificate Misissuance in the Wild t127

https://zakird.com/papers/zlint.pdf
PKIX Working Group t50

https://datatracker.ietf.org/wg/pkix/charter/
The CA/Browser Forum t52

https://cabforum.org/
RFC 5280: Internet X.509 Public Key Infrastructure Certificate and CRL Profile t51

https://tools.ietf.org/html/rfc5280
Baseline Requirements t54

https://cabforum.org/baseline-requirements/
EV SSL Certificate Guidelines t53

https://cabforum.org/extended-validation/
X.680 : Information technology - ASN.1 t56

https://www.itu.int/rec/T-REC-X.680
WebTrust seal program t55

https://www.cpacanada.ca/en/business-and-accounting-resources/audit-and-assurance/overview-of-webtrust-services
A Warm Welcome to ASN.1 and DER t58

https://letsencrypt.org/docs/a-warm-welcome-to-asn1-and-der/
ASN.1 JavaScript decoder t57

https://lapo.it/asn1js/
der-ascii t59

https://github.com/google/der-ascii
Chain of Trust t61

https://letsencrypt.org/certificates/
Bug 725451: Support enforcing nested EKU constraints, do so by default t60

https://bugzilla.mozilla.org/show_bug.cgi?id=725351
Preloading Intermediate CA Certificates into Firefox t63

https://blog.mozilla.org/security/2020/11/13/preloading-intermediate-ca-certificates-into-firefox/
Standing on Our Own Two Feet t62

https://letsencrypt.org/2020/11/06/own-two-feet.html
Available trusted root certificates for Apple operating systems t65

https://support.apple.com/en-us/HT209143
Apple Root Certificate Program t64

https://www.apple.com/certificateauthority/ca_program.html
Program Requirements - Microsoft Trusted Root Program t67

https://docs.microsoft.com/en-us/security/trusted-root/program-requirements
Chrome Root Program t66

https://www.chromium.org/Home/chromium-security/root-ca-policy
dev-security-policy t69

https://groups.google.com/a/mozilla.org/g/dev-security-policy
Mozilla CA Certificate Policy t68

https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/policy/
ocsp-stapling.md t70

https://gist.github.com/sleevi/5efe9ef98961ecfb4da8
Improving Revocation: OCSP Must-Staple and Short-lived Certificates t72

https://blog.mozilla.org/security/2015/11/23/improving-revocation-ocsp-must-staple-and-short-lived-certificates/
X.509v3 TLS Feature Extension t71

https://tools.ietf.org/html/rfc7633
Certificate Transparency t74

https://www.imperialviolet.org/2011/11/29/certtransparency.html
Fixing CAs t73

https://www.links.org/?p=1212
certificate-transparency mailing list t76

https://groups.google.com/u/1/g/certificate-transparency
The Right Key mailing list t75

https://www.ietf.org/mailman/listinfo/therightkey
Sustaining Digital Certificate Security t78

https://security.googleblog.com/2015/10/sustaining-digital-certificate-security.html
Extended Validation in Chrome t77

https://www.certificate-transparency.org/ev-ct-plan
Announcement: Requiring Certificate Transparency in 2017 t79

https://groups.google.com/a/chromium.org/g/ct-policy/c/78N3SMcqUGw/m/ykIwHXuqAQAJ
Issue 679012: Expect-CT HTTP header t81

https://bugs.chromium.org/p/chromium/issues/detail?id=679012
Certificate Transparency in Chrome - Change to Enforcement Date t80

https://groups.google.com/a/chromium.org/g/ct-policy/c/sz_3W_xKBNY/m/6jq2ghJXBAAJ
[Trans] WGLC comments on draft-ietf-trans-6962-bis-24 t83

https://mailarchive.ietf.org/arch/msg/trans/gO_DFW3v9FmBCOek_hifZ6KL368/
Apple's Certificate Transparency policy t82

https://support.apple.com/en-us/HT205280
Trillian t85

https://github.com/google/trillian
How will Certificate Transparency Logs be Audited in Practice? t84

https://www.agwa.name/blog/post/how_will_certificate_transparency_logs_be_audited_in_practice
Certificate Transparency: SCT Auditing t87

https://www.hardenize.com/blog/certificate-transparency-sct-auditing
Tamper-Evident Logs t86

https://transparency.dev
Certificate Transparency Version 2.0 t89

https://datatracker.ietf.org/doc/draft-ietf-trans-rfc6962-bis/
RFC 6962: Certificate Transparency t88

https://datatracker.ietf.org/doc/rfc6962/
Chromium Certificate Transparency Policy t90

https://github.com/chromium/ct-policy
Ballot 181—Make CAA Checking Mandatory t92

https://cabforum.org/2017/03/08/ballot-187-make-caa-checking-mandatory/
RFC 8659: DNS CAA Resource Record t91

https://tools.ietf.org/html/rfc8659
CAA Record Generator t94

https://sslmate.com/labs/caa/
Who Supports CAA? t93

https://sslmate.com/caa/support
RFC 8657: CAA Record Extensions for Account URI and ACME Method Binding t96

https://tools.ietf.org/html/rfc8657
CAA Test Suite t95

https://caatestsuite.com
A First Look at Certification Authority Authorization t98

https://taejoong.github.io/pubs/publications/quirin-2018-caa.pdf
CAA incidents in Mozilla’s issue tracker t97

https://bugzilla.mozilla.org/buglist.cgi?short_desc_type=allwordssubstr&component=CA%20Certificate%20Compliance&component=CA%20Certificate%20Root%20Program&resolution=FIXED&resolution=INVALID&resolution=WONTFIX&resolution=INACTIVE&resolution=DUPLICATE&resolution=WORKSFORME&resolution=INCOMPLETE&resolution=SUPPORT&resolution=EXPIRED&resolution=MOVED&query_format=advanced&classification=Client%20Software&classification=Developer%20Infrastructure&classification=Components&classification=Server%20Software&classification=Other&list_id=15711306&bug_status=UNCONFIRMED&bug_status=NEW&bug_status=ASSIGNED&bug_status=REOPENED&bug_status=RESOLVED&bug_status=VERIFIED&bug_status=CLOSED&short_desc=CAA
CAA Study t99

https://caastudy.github.io

5. Attacks against PKI

Distrusting New CNNIC Certificates t201

https://blog.mozilla.org/security/2015/04/02/distrusting-new-cnnic-certificates/
Maintaining digital certificate security t200

https://googleonlinesecurity.blogspot.co.uk/2015/03/maintaining-digital-certificate-security.html
Distrusting WoSign and StartCom Certificates t221

https://security.googleblog.com/2016/10/distrusting-wosign-and-startcom.html
Distrusting New WoSign and StartCom Certificates t220

https://blog.mozilla.org/security/2016/10/24/distrusting-new-wosign-and-startcom-certificates/
SHAttered t223

https://shattered.io/
Announcing the first SHA1 collision t222

https://security.googleblog.com/2017/02/announcing-first-sha1-collision.html
Kazakhstan’s HTTPS Interception Live (Again) t218

https://censoredplanet.org/kazakhstan/live
Kazakhstan government is intercepting HTTPS traffic in its capital t217

https://www.zdnet.com/article/kazakhstan-government-is-intercepting-https-traffic-in-its-capital/
CA:WoSign Issues t219

https://wiki.mozilla.org/CA:WoSign_Issues
Protecting Chrome users in Kazakhstan t214

https://security.googleblog.com/2019/08/protecting-chrome-users-in-kazakhstan.html
Google and Mozilla block Kazakhstan root CA certificate from Chrome and Firefox t213

https://venturebeat.com/2019/08/21/google-and-mozilla-block-kazakhstan-root-ca-certificate-from-chrome-and-firefox/
Kazakhstan’s HTTPS Interception t216

https://censoredplanet.org/kazakhstan
Protecting our Users in Kazakhstan t215

https://blog.mozilla.org/security/2019/08/21/protecting-our-users-in-kazakhstan/
Add Symantec Test Certs to OneCRL t210

https://bugzilla.mozilla.org/show_bug.cgi?id=1214321
Vice Minister: Installing a "security certificate" is up to users t212

https://rus.azattyq.org/a/30064788.html
Kazakhtelecom JSC notifies on introduction of National security certificate from 1 January 2016 t211

https://web.archive.org/web/20151202203337/http://telecom.kz/en/news/view/18729
Dates for phasing out MD5-based signatures and 1024-bit moduli t207

https://wiki.mozilla.org/CA:MD5and1024
Google certificates upgrade in progress t206

https://developers.googleblog.com/2013/07/google-certificates-upgrade-in-progress.html
Improved Digital Certificate Security t209

https://security.googleblog.com/2015/09/improved-digital-certificate-security.html
Bug #1156844 - Turn off trust bits for Equifax Secure Certificate Authority 1024-bit root certificate t208

https://bugzilla.mozilla.org/show_bug.cgi?id=1156844
HTTPS Everywhere t203

https://www.eff.org/https-everywhere
Consequences of mis-issuance under CNNIC t202

https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/czwlDNbwHXM/Fj-LUvhVQYEJ
Facebook's outmoded Web crypto opens door to NSA spying t205

https://www.cnet.com/news/facebooks-outmoded-web-crypto-opens-door-to-nsa-spying/
On the Cost of Factoring RSA-1024 t204

https://www.tau.ac.il/~tromer/papers/cbtwirl.pdf
How do you handle mass revocation requests? t243

https://groups.google.com/g/mozilla.dev.security.policy/c/wxX4Yv0E3Mk
RFC 8737: ACME TLS ALPN Challenge Extension t242

https://tools.ietf.org/html/rfc8737
@cujanovic’s tweet t245

https://twitter.com/cujanovic/status/969229397508153350
Distrusted Symantec® SSL Replacement t244

https://www.trustico.com/news/2018/symantec-revocation/certificate-replacement.php
How I exploited ACME TLS-SNI-01 t241

https://labs.detectify.com/2018/01/12/how-i-exploited-acme-tls-sni-01-issuing-lets-encrypt-ssl-certs-for-any-domain-using-shared-hosting/
Issue with TLS-SNI-01 and Shared Hosting Infrastructure t240

https://community.letsencrypt.org/t/2018-01-09-issue-with-tls-sni-01-and-shared-hosting-infrastructure/49996
Ballot 169—Revised Validation Requirements t239

https://cabforum.org/2016/08/05/ballot-169-revised-validation-requirements/
Incident Report—OCR t236

https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg04654.html
Incident Report—certificate with 'sb' as a SAN:dnsName t235

https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg04274.html
Re: Incident Report—Certificates issued without proper domain validation t238

https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05403.html
Incident Report—Certificates issued without proper domain validation t237

https://www.mail-archive.com/dev-security-policy@lists.mozilla.org/msg05398.html
Chrome’s Plan to Distrust Symantec Certificates t232

https://security.googleblog.com/2017/09/chromes-plan-to-distrust-symantec.html
Re: Intent to Deprecate and Remove: Trust in existing Symantec-issued Certificates t231

https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKwjihhBs/m/i70m8ptvCQAJ
StartEncrypt considered harmful today t234

https://www.computest.nl/blog/startencrypt-considered-harmful-today/
DigiCert to Acquire Symantec’s Website Security Business t233

https://www.digicert.com/dc/blog/digicert-to-acquire-symantec-website-security-business/
Symantec: Mis-issued test certificates by CrossCert t230

https://bugzilla.mozilla.org/show_bug.cgi?id=1334377
Intent to Deprecate and Remove: Trust in existing Symantec-issued Certificates t229

https://groups.google.com/a/chromium.org/g/blink-dev/c/eUAKwjihhBs
SHA-1 is a Shambles t228

https://sha-mbles.github.io
SHA1 collisions make Git vulnerable to attacks by third-parties, not just repo maintainers t225

https://www.metzdowd.com/pipermail/cryptography/2017-February/031623.html
Tweet about SHA1 collision reuse t224

https://twitter.com/realhashbreaker/status/835920234594861056
New collision attacks on SHA-1 based on optimal joint local-collision analysis t227

https://marc-stevens.nl/research/papers/EC13-S.pdf
sha1collisiondetection t226

https://github.com/cr-marcstevens/sha1collisiondetection
Cryptanalysis of MD5 Compress t144

https://cseweb.ucsd.edu/~bsy/dobbertin.ps
Collisions for the compression function of MD5 t143

https://securewww.esat.kuleuven.be/cosic/publications/article-143.pdf
Colliding X.509 Certificates based on MD5-collisions t146

https://www.win.tue.nl/~bdeweger/CollidingCertificates/
Collisions for hash functions MD4, MD5, HAVAL-128, and RIPEMD t145

https://eprint.iacr.org/2004/199.pdf
Unbelievable! t140

https://groups.google.com/forum/#!topic/mozilla.dev.tech.crypto/nAzIKSBEh78
MD5 considered harmful today t142

https://www.win.tue.nl/hashclash/rogue-ca/
Re: Unbelievable! t141

https://groups.google.com/forum/#!msg/mozilla.dev.tech.crypto/nAzIKSBEh78/I1nFwuUkOF8J
video t137

https://www.youtube.com/watch?v=XCjoJePnRBY
slides t136

https://defcon.org/images/defcon-17/dc-17-presentations/defcon-17-zusman-hacking_pki.pdf
SSL Certificate for Mozilla.com Issued Without Validation t139

https://www.sslshopper.com/article-ssl-certificate-for-mozilla.com-issued-without-validation.html
(Un)trusted Certificates t138

https://web.archive.org/web/20110615055112/https://blog.startcom.org/?p=145
A Finnish man created this simple email account - and received Microsoft's security certificate t133

https://www.tivi.fi/uutiset/a-finnish-man-created-this-simple-email-account-and-received-microsofts-security-certificate/84101245-1867-37df-af1a-cd5d6ada7de8
Mike's Thawte tweet t132

https://twitter.com/schmoilito/statuses/1089348859
Full Disclosure t135

https://web.archive.org/web/20160312132143/https://blog.startcom.org/?p=161
Nobody is perfect t134

http://schmoil.blogspot.co.uk/2009/01/nobody-is-perfect.html
DNS vuln + SSL cert = FAIL t131

https://web.archive.org/web/20100809095612/http://intrepidusgroup.com/insight/2008/07/dns-vuln-ssl-cert-fail/
Microsoft, VeriSign, and Certificate Revocation t130

https://web.archive.org/web/20151225181749/http://amug.org/~glguerin/opinion/revocation.html
Erroneous VeriSign-Issued Digital Certificates Pose Spoofing Hazard t129

https://technet.microsoft.com/library/security/ms01-017
Let's Encrypt: Incomplete revocation for CAA rechecking bug t247

https://bugzilla.mozilla.org/show_bug.cgi?id=1619179
Let's Encrypt: CAA Rechecking bug t246

https://bugzilla.mozilla.org/show_bug.cgi?id=1619047
Cyber War t160

https://web.archive.org/web/20120402115209/https://blog.startcom.org/?p=229
ComodoHacker’s Pastebin t166

https://pastebin.com/u/ComodoHacker
September 2011 Security Incident Report t165

https://web.archive.org/web/20140202142309/https://www.globalsign.com/company/press/121311-security-incident-report.html
Bug #698753: Entrust SubCA: 512-bit key issuance and other CPS violations; malware in the wild t168

https://bugzilla.mozilla.org/show_bug.cgi?id=698753
ich sun on Twitter t167

https://twitter.com/ichsunx2
DigiNotar public report version 1 t162

https://www.rijksoverheid.nl/ministeries/ministerie-van-binnenlandse-zaken-en-koninkrijksrelaties/documenten/rapporten/2011/09/05/diginotar-public-report-version-1
Is This MITM Attack to Gmail's SSL ? t161

https://productforums.google.com/forum/#!msg/gmail/3J3r2JqFNTw/oHHZLJeedHMJ
Striking Back... t164

https://pastebin.com/1AxH30em
Black Tulip Update t163

https://web.archive.org/web/20150906215523/https://www.rijksoverheid.nl/documenten/rapporten/2012/08/13/black-tulip-update
Response to some comments t159

https://pastebin.com/GkKUhu35
Another status update message t158

https://pastebin.com/85WV10EL
RE: Web Browsers and Comodo Announce A Successful Certificate Authority Attack, Perhaps From Iran t155

https://groups.google.com/forum/#!msg/mozilla.dev.security.policy/zgKmHOTIxn8/5NNYcgPNqlgJ
Detecting Certificate Authority compromises and web browser collusion t154

https://blog.torproject.org/blog/detecting-certificate-authority-compromises-and-web-browser-collusion
New hack on Comodo reseller exposes private data t157

https://www.theregister.com/2011/05/24/comodo_reseller_hacked/
A message from Comodo Hacker t156

https://pastebin.com/74KXCaEZ
This morning's MD5 attack - resolved t151

https://web.archive.org/web/20110806064206/http://www.symantec.com/connect/blogs/mornings-md5-attack-resolved
Verisign and responsible disclosure t150

http://www.phreedom.org/blog/2009/verisign-and-responsible-disclosure/
Bug 642395: Deal with bogus certs issued by Comodo partner t153

https://bugzilla.mozilla.org/show_bug.cgi?id=642395
Comodo Report of Incident t152

https://www.comodo.com/Comodo-Fraud-Incident-2011-03-23.html
What is Flame? t148

https://web.archive.org/web/20121010063428/http://www.kaspersky.com/flame
Colliding X.509 Certificates for Different Identities t147

https://www.win.tue.nl/hashclash/TargetCollidingCertificates/
CWI cryptanalyst discovers new cryptographic attack variant in Flame spy malware t149

https://www.cwi.nl/news/2012/cwi-cryptanalist-discovers-new-cryptographic-attack-variant-in-flame-spy-malware
Further improving digital certificate security t180

https://googleonlinesecurity.blogspot.co.uk/2013/12/further-improving-digital-certificate.html
Improperly Issued Digital Certificates Could Allow Spoofing t182

https://technet.microsoft.com/library/security/2916652
Revoking Trust in one ANSSI Certificate t181

https://blog.mozilla.org/security/2013/12/09/revoking-trust-in-one-anssi-certificate/
hey @Gogo, why are you issuing *.google.com certificates on your planes? t188

https://twitter.com/__apf__/status/551083956326920192
A survey and analysis of TLS interception mechanisms and motivations t187

https://arxiv.org/abs/2010.16388
Our Technology Statement from Gogo regarding our streaming video policy t189

https://web.archive.org/web/20150404014855/http://concourse.gogoair.com/technology/statement-gogo-regarding-streaming-video-policy
Revoking Trust in one ANSSI Certificate t184

https://groups.google.com/forum/#!topic/mozilla.dev.security.policy/uCZi6Ua-uPA
Revocation of an IGC/A branch t183

https://web.archive.org/web/20141202143116/http://www.ssi.gouv.fr/en/the-anssi/events/revocation-of-an-igc-a-branch-808.html
Maintaining digital certificate security t186

https://googleonlinesecurity.blogspot.co.uk/2014/07/maintaining-digital-certificate-security.html
Announcing Version 2.1 of Mozilla CA Certificate Policy t185

https://blog.mozilla.org/security/2013/02/15/announcing-version-2-1-of-mozilla-ca-certificate-policy/
DigiCert, Inc. Of No Relation to Recent "Digi" Insecure Certificates t171

https://www.digicert.com/news/2011-11-1-breaches-and-similar-names.htm
Revoking Trust in DigiCert Sdn. Bhd Intermediate Certificate Authority t170

https://blog.mozilla.org/security/2011/11/03/revoking-trust-in-digicert-sdn-bhd-intermediate-certificate-authority/
Counter-cryptanalysis t177

https://marc-stevens.nl/research/papers/C13-S.pdf
Microsoft Sub-CA used in malware signing t176

https://lists.randombit.net/pipermail/cryptography/2012-June/002992.html
Public Announcements t179

https://web.archive.org/web/20130926134541/http://turktrust.com.tr/en/kamuoyu-aciklamasi-en.2.html
Enhancing digital certificate security t178

https://googleonlinesecurity.blogspot.co.uk/2013/01/enhancing-digital-certificate-security.html
Flame / Skywiper / Flamer reports t173

https://web.archive.org/web/20120820145510/http://www.crysys.hu/targeted-attacks.html
Identification of a New Targeted Cyber-Attack t172

https://web.archive.org/web/20140331222159/http://www.certcc.ir/index.php?name=news&file=article&sid=1894
Snack Attack: Analyzing Flame’s Replication Pattern t175

https://threatpost.com/snack-attack-analyzing-flames-replication-pattern-060712/76660/
Analyzing the MD5 collision in Flame t174

https://blog.trailofbits.com/2012/06/11/analyzing-the-md5-collision-in-flame/
Entrust Bulletin on Certificates Issued with Weak 512-bit RSA Keys by Digicert Malaysia t169

https://web.archive.org/web/20150629012844/http://www.entrust.net/advisories/malaysia.htm
#Superfish Round-Up t191

https://noncombatant.org/2015/02/21/superfish-round-up/
Gogo no longer issuing fake Google SSL certificates t190

https://www.runwaygirlnetwork.com/2015/01/13/gogo-no-longer-issuing-fake-google-ssl-certificates/
Komodia/Superfish SSL Validation is broken t193

https://blog.filippo.io/komodia-superfish-ssl-validation-is-broken/
Extracting the SuperFish certificate t192

https://blog.erratasec.com/2015/02/extracting-superfish-certificate.html#.YT0VGS1Q0gg
The Risks of SSL Inspection t199

https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.html
Comodo ships Adware Privdog worse than Superfish t198

https://blog.hboeck.de/archives/865-Software-Privdog-worse-than-Superfish.html
MSRT March: Superfish cleanup t195

https://web.archive.org/web/20160409040200/https://blogs.technet.microsoft.com/mmpc/2015/03/09/msrt-march-superfish-cleanup/
Windows SSL Interception Gone Wild t194

https://web.archive.org/web/20150223152047/https://www.facebook.com/notes/protect-the-graph/windows-ssl-interception-gone-wild/1570074729899339
Check for bad certs from Komodia / Superfish t197

https://superfish.tlsfun.de/
Superfish, Komodia, PrivDog vulnerability test t196

https://filippo.io/Badfish/

6. HTTP and Browser Issues

A study of what really breaks SSL t300

https://blog.ivanristic.com/2011/05/a-study-of-what-really-breaks-ssl.html
RFC 6960: X.509 Internet PKI Online Certificate Status Protocol t320

https://tools.ietf.org/html/rfc6960
Revocation doesn't work t322

https://www.imperialviolet.org/2011/03/18/revocation.html
RFC 5019: The Lightweight OCSP Profile for High-Volume Environments t321

https://tools.ietf.org/html/rfc5019
Sub-Prime PKI: Attacking Extended Validation SSL t317

https://www.blackhat.com/presentations/bh-usa-09/ZUSMAN/BHUSA09-Zusman-AttackExtSSL-SLIDES.pdf
Beware of Finer-Grained Origins t316

https://seclab.stanford.edu/websec/origins/fgo.pdf
How certificate revocation (doesn’t) work in practice t319

https://news.netcraft.com/archives/2013/05/13/how-certificate-revocation-doesnt-work-in-practice.html
NIST Workshop: Improving Trust in the Online Marketplace t318

https://csrc.nist.gov/groups/ST/ca-workshop-2013/presentations/Koski_ca-workshop2013.pdf
Upcoming Change to Chrome's Identity Indicators t313

https://groups.google.com/a/chromium.org/g/security-dev/c/h1bTcoTpfeI
Minutes for CA/Browser Forum F2F Meeting 44 t312

https://cabforum.org/2018/06/06/minutes-for-ca-browser-forum-f2f-meeting-44-london-6-7-june-2018/#Apple-Root-Program-Update
BIMI t315

https://bimigroup.org
Improved Security and Privacy Indicators in Firefox 70 t314

https://blog.mozilla.org/security/2019/10/15/improved-security-and-privacy-indicators-in-firefox-70/
On Comodo CA’s Recent Revocation of an SSL Certificate for Kentucky-based Stripe, Inc. t311

https://web.archive.org/web/20180503161444/https://www.comodoca.com/en-us/about/blog/on-comodo-ca%E2%80%99s-recent-revocation-of-an-ssl-certifi/
Extended Validation Is Broken t310

https://web.archive.org/web/20171211181630/https://stripe.ian.sh/
Firefox and Chrome start warning about insecure login forms t306

https://www.feistyduck.com/bulletproof-tls-newsletter/issue_24_firefox_and_chrome_start_warning_about_insecure_login_forms
Percentage of Web Pages Loaded by Firefox Using HTTPS t305

https://letsencrypt.org/stats/
Deprecating Powerful Features on Insecure Origins t308

https://sites.google.com/a/chromium.org/dev/Home/chromium-security/deprecating-powerful-features-on-insecure-origins
A milestone for Chrome security: marking HTTP as “not secure” t307

https://www.blog.google/products/chrome/milestone-chrome-security-marking-http-not-secure/
UpgradeInsecureRequestsEnabled t302

https://chromestatus.com/metrics/feature/timeline/popularity/740
A Dangerous Mix: Large-scale analysis of mixed-content websites t301

https://www.securitee.org/files/mixedinc_isc2013.pdf
Google Transparency Report: HTTPS t304

https://www.google.com/transparencyreport/https/metrics/
Marking HTTP As Non-Secure t303

https://www.chromium.org/Home/chromium-security/marking-http-as-non-secure
First part of phishing with EV t309

https://web.archive.org/web/20171212030739/https://0.me.uk/ev-phishing/
Is the Web Ready for OCSP Must-Staple? t339

https://www.ccs.neu.edu/home/amislove/publications/OCSP-IMC.pdf
RFC 7633: X.509v3 TLS Feature Extension t338

https://datatracker.ietf.org/doc/rfc7633/
Sane time t335

https://www.chromium.org/developers/design-documents/sane-time
Where the Wild Warnings Are: Root Causes of Chrome HTTPS Certificate Errors t334

https://static.googleusercontent.com/media/research.google.com/en//pubs/archive/46359.pdf
High-reliability OCSP stapling and why it matters t337

https://blog.cloudflare.com/high-reliability-ocsp-stapling/
RFC 6066: TLS Extensions: Extension Definitions t336

https://tools.ietf.org/html/rfc6066
OCSP Uptime t331

https://uptime.netcraft.com/perf/reports/OCSP
CRLite: A Scalable System for Pushing All TLS Revocations to All Browsers t330

https://obj.umiacs.umd.edu/papers_for_stories/crlite_oakland17.pdf
The Case for Prefetching and Prevalidating TLS Server Certificates t333

https://crypto.stanford.edu/%7Edabo/pubs/papers/ssl-prefetch.pdf
Certificate revocation and the performance of OCSP t332

https://news.netcraft.com/archives/2013/04/16/certificate-revocation-and-the-performance-of-ocsp.html
CA:Revocation Plan t328

https://wiki.mozilla.org/CA:RevocationPlan
Revoking Intermediate Certificates: Introducing OneCRL t327

https://blog.mozilla.org/security/2015/03/03/revoking-intermediate-certificates-introducing-onecrl/
Introducing CRLite: All of the Web PKI’s revocations, compressed t329

https://blog.mozilla.org/security/2020/01/09/crlite-part-1-all-web-pki-revocations-compressed/
CRL and OCSP behavior of iOS / Security.Framework? t324

https://stackoverflow.com/questions/5625642/crl-and-ocsp-behavior-of-ios-security-framework
Defeating OCSP With The Character '3' t323

https://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatOCSP-PAPER2.pdf
CRLSets t326

https://dev.chromium.org/Home/chromium-security/crlsets
Revocation checking and Chrome's CRL t325

https://www.imperialviolet.org/2012/02/05/crlsets.html
Hacking Github with Webkit t265

https://homakov.blogspot.co.uk/2013/03/hacking-github-with-webkit.html
Deprecate modification of 'secure' cookies from non-secure origins t264

https://tools.ietf.org/html/draft-west-leave-secure-cookies-alone-05
RFC 6797: HTTP Strict Transport Security t267

https://tools.ietf.org/html/rfc6797
Understanding Cookie Security t266

https://kuza55.blogspot.co.uk/2008/02/understanding-cookie-security.html
Feature: Strict Secure Cookies t261

https://www.chromestatus.com/feature/4506322921848832
New Ways I’m Going to Hack Your Web App t260

https://citeseerx.ist.psu.edu/viewdoc/download?doi=10.1.1.452.2038&rep=rep1&type=pdf
Multiple Browser Cookie Injection Vulnerabilities t263

https://www.westpoint.ltd.uk/advisories/wp-04-0001.txt
Feature: Schemeful same-site t262

https://chromestatus.com/feature/5096179480133632
Cross-Site Cooking t258

https://web.archive.org/web/20060603050359/https://www.securityfocus.com/archive/107/423375/30/0/threaded
Cookies: HTTP State Management Mechanism t257

https://datatracker.ietf.org/doc/draft-ietf-httpbis-rfc6265bis/
Cookie forcing t259

https://scarybeastsecurity.blogspot.co.uk/2008/11/cookie-forcing.html
HTTPS Cookie Stealing t254

https://fscked.org/talks/ActiveHTTPSCookieStealing.pdf
Active Gmail "Sidejacking" - https is NOT ENOUGH t253

https://seclists.org/bugtraq/2007/Aug/70
RFC 6265: HTTP State Management Mechanism t256

https://tools.ietf.org/html/rfc6265
CookieMonster t255

https://fscked.org/projects/cookiemonster
BlackSheep t250

https://www.zscaler.com/tools/blacksheep
Idiocy t252

https://jonty.co.uk/idiocy
FireShepherd t251

https://notendur.hi.is/gas15/FireShepherd/
Firesheep announcement t249

https://codebutler.com/firesheep/
SideJacking with Hamster t248

https://blog.erratasec.com/2007/08/sidejacking-with-hamster_05.html
Exploring User Reactions to New Browser Cues for Extended Validation Certificates t281

https://www.ccsl.carleton.ca/paper-archive/sobey-esorics-08.pdf
A Week to Remember: The Impact of Browser Warning Storage Policies t280

https://www.usenix.org/conference/soups2016/technical-sessions/presentation/weinberger
Protecting users from insecure downloads in Google Chrome t287

https://blog.chromium.org/2020/02/protecting-users-from-insecure.html
Mobile Users Three Times More Vulnerable to Phishing Attacks t286

https://securityintelligence.com/mobile-users-3-times-more-vulnerable-to-phishing-attacks/
Google Analytics Usage Statistics t289

https://trends.builtwith.com/analytics/Google-Analytics
Microsoft Edge and mixed content downloads t288

https://docs.microsoft.com/en-us/deployedge/edge-learnmore-mixed-content-downloads
The Web's Identity Crisis: Understanding the Effectiveness of Website Identity Indicators t283

https://www.usenix.org/conference/usenixsecurity19/presentation/thompson
An Evaluation of Extended Validation and Picture-in-Picture Phishing Attacks t282

https://www.adambarth.com/papers/2007/jackson-simon-tan-barth.pdf
Measuring SSL Indicators on Mobile Browsers: Extended Life, or End of the Road? t285

https://www.cise.ufl.edu/~traynor/papers/amrutkar-isc12.pdf
Web Security Context: User Interface Guidelines t284

https://www.w3.org/TR/wsc-ui/
Experimenting At Scale With Google Chrome’s SSL Warning t279

https://www.robreeder.com/pubs/sslExperimentCHI2014.pdf
sslsniff t270

https://github.com/moxie0/sslsniff
Bug 460374: All certificates show not trusted - get error code (MITM in-the-wild) t276

https://bugzilla.mozilla.org/show_bug.cgi?id=460374
TODO: Break Internet t275

https://blog.johnath.com/2007/10/11/todo-break-internet/
Alice in Warningland: A Large-Scale Field Study of Browser Security Warning Effectiveness t278

https://www.usenix.org/conference/usenixsecurity13/technical-sessions/presentation/akhawe
On the Challenges in Usable Security Lab Studies: Lessons Learned from Replicating a Study on SSL Warnings t277

https://cups.cs.cmu.edu/soups/2011/proceedings/a3_Sotirakopoulos.pdf
Where the Wild Warnings Are: Root Causes of Chrome Certificate Errors t272

https://research.google/pubs/pub46359/
SSLsplit - transparent and scalable SSL/TLS interception t271

https://www.roe.ch/SSLsplit
Bug 431827: Exceptions for invalid SSL certificates are too easy to add t274

https://bugzilla.mozilla.org/show_bug.cgi?id=431827
Here’s My Cert, So Trust Me, Maybe? Understanding TLS Errors on the Web t273

https://www.icsi.berkeley.edu/pubs/networking/ICSI_heresmycert13.pdf
sslstrip t269

https://github.com/moxie0/sslstrip
Cookie Prefixes t268

https://datatracker.ietf.org/doc/draft-ietf-httpbis-cookie-prefixes/
Use AdSense on your HTTPS sites t290

https://adsense.blogspot.co.uk/2013/09/use-adsense-on-your-https-sites13.html
Trying to end mixed scripting vulnerabilities t292

https://googleonlinesecurity.blogspot.co.uk/2011/06/trying-to-end-mixed-scripting.html
Mixed Content Level 2 Editor’s Draft t291

https://w3c.github.io/webappsec-mixed-content/
SSL, TLS and a Little ActiveX: How IE7 Strikes a Balance Between Security and Compatibility t298

https://blogs.msdn.microsoft.com/ie/2006/10/18/ssl-tls-and-a-little-activex-how-ie7-strikes-a-balance-between-security-and-compatibility/
Mixed Content Blocking Enabled in Firefox 23! t297

https://blog.mozilla.org/tanvi/2013/04/10/mixed-content-blocking-enabled-in-firefox-23/
Internet Explorer 9 Security Part 4: Protecting Consumers from Malicious Mixed Content t299

https://blogs.msdn.microsoft.com/ie/2011/06/23/internet-explorer-9-security-part-4-protecting-consumers-from-malicious-mixed-content/
PSA: Tightening Blink's mixed content behavior t294

https://groups.google.com/a/chromium.org/forum/#!msg/blink-dev/Uxzvrqb6IeU/9FAie9Py4cIJ
Ending mixed scripting vulnerabilities t293

https://blog.chromium.org/2012/08/ending-mixed-scripting-vulnerabilities.html
Bug 62178: Implement mechanism to prevent sending insecure requests from a secure context t296

https://bugzilla.mozilla.org/show_bug.cgi?id=62178
No More Mixed Messages About HTTPS t295

https://blog.chromium.org/2019/10/no-more-mixed-messages-about-https.html

7. Implementation Issues

Virtual Host Confusion: Weaknesses and Exploits t412

https://www.blackhat.com/docs/us-14/materials/us-14-Delignat-The-BEAST-Wins-Again-Why-TLS-Keeps-Failing-To-Protect-HTTP-wp.pdf
MitM DNS Rebinding SSL/TLS Wildcards and XSS t411

https://web.archive.org/web/20150315042723/http://ha.ckers.org/blog/20100822/mitm-dns-rebinding-ssltls-wildcards-and-xss/
ALPACA Attack t413

https://www.usenix.org/conference/usenixsecurity21/presentation/brinkmann
Triple Handshakes and Cookie Cutters t410

https://mitls.org/pages/attacks/3SHAKE
TLS Symmetric Crypto t405

https://www.imperialviolet.org/2014/02/27/tlssymmetriccrypto.html
RFC 7507: TLS Fallback SCSV for Preventing Protocol Downgrade Attacks t404

https://datatracker.ietf.org/doc/rfc7507/
Internet Explorer should send TLS_FALLBACK_SCSV t407

https://web.archive.org/web/20150912211710/https://connect.microsoft.com/IE/feedback/details/1002874/internet-explorer-should-send-tls-fallback-scsv
The POODLE Attack and the End of SSL 3.0 t406

https://blog.mozilla.org/security/2014/10/14/the-poodle-attack-and-the-end-of-ssl-3-0/
SCSVs and SSLv3 fallback t401

https://www.ietf.org/mail-archive/web/tls/current/msg09450.html
Managing and removing automatic version rollback in TLS Clients t400

https://datatracker.ietf.org/doc/draft-pettersen-tls-version-rollback-removal/
An SCSV to stop TLS fallback. t403

https://www.ietf.org/mail-archive/web/tls/current/msg10676.html
TLS Fallback SCSV for Preventing Protocol Downgrade Attacks t402

https://tools.ietf.org/html/draft-bmoeller-tls-downgrade-scsv-02
Truncating TLS Connections to Violate Beliefs in Web Applications t409

https://www.usenix.org/system/files/conference/woot13/woot13-smyth.pdf
RFC 8701: Applying GREASE to TLS Extensibility t408

https://datatracker.ietf.org/doc/draft-ietf-tls-grease/
Incorrect checks for malformed signatures t342

https://www.openssl.org/news/secadv/20090107.txt
Analysis of vulnerability GNUTLS-SA-2008-3 CVE-2008-4989 t341

http://article.gmane.org/gmane.comp.encryption.gpg.gnutls.devel/3217
About the security content of iOS 7.0.6 t344

https://support.apple.com/en-gb/HT202934
TWSL2011-007: iOS SSL Implementation Does Not Validate Certificate Chain t343

https://seclists.org/fulldisclosure/2011/Jul/315
Certificate Validation Flaw Could Enable Identity Spoofing t340

https://technet.microsoft.com/library/security/ms02-050
Debian and OpenSSL: The Aftermath t364

https://www.links.org/?p=328
Vendors Are Bad For Security t363

https://www.links.org/?p=327
RNG Bug May Result in Weak Cryptographic Keys t366

https://ftp.netbsd.org/pub/NetBSD/security/advisories/NetBSD-SA2013-003.txt.asc
Microsoft confirms that XP contains random number generator bug t365

https://web.archive.org/web/20080622122347/http://www.computerworld.com/action/article.do?command=viewArticleBasic&articleId=9048438
unssl.c t360

https://web.archive.org/web/20101028073625/http://www.mavi1.org/web_security/cryptography/General/unssl.c
Working exploit for Debian generated SSH Keys t362

https://seclists.org/fulldisclosure/2008/May/410
DSA-1571-1: openssl -- predictable random number generator t361

https://www.debian.org/security/2008/dsa-1571
More Tricks For Defeating SSL In Practice t357

https://www.blackhat.com/presentations/bh-usa-09/MARLINSPIKE/BHUSA09-Marlinspike-DefeatSSL-SLIDES.pdf
PKI Layer Cake: New Collision Attacks Against the Global X.509 Infrastructure t356

https://securewww.esat.kuleuven.be/cosic/publications/article-1432.pdf
Randomness and the Netscape Browser t359

https://people.eecs.berkeley.edu/~daw/papers/ddj-netscape.html
Why TLS is better without STARTTLS t358

https://nostarttls.secvuln.info
Using Frankencerts for Automated Adversarial Testing of Certificate Validation in SSL/TLS Implementations t353

https://www.cs.utexas.edu/%7Eshmat/shmat_oak14.pdf
Add openssl_altchainsforgery_mitm_proxy.rb t352

https://github.com/rapid7/metasploit-framework/pull/5735
The most dangerous code in the world: validating SSL certificates in non-browser software t355

https://crypto.stanford.edu/~dabo/pubs/abstracts/ssl-client-bugs.html
Frankencert t354

https://github.com/sumanj/frankencert
Add test for CVE-2015-1793 t351

https://github.com/openssl/openssl/commit/593e9c638c58e1a510c519db0d024527113330f3
Alternative chains certificate forgery t350

https://openssl.org/news/secadv/20150709.txt
Early ChangeCipherSpec Attack t349

https://www.imperialviolet.org/2014/06/05/earlyccs.html
Advisories t346

https://gnutls.org/security.html
Apple's SSL/TLS bug t345

https://www.imperialviolet.org/2014/02/22/applebug.html
OpenSSL Security Advisory CVE-2014-0224 t348

https://www.openssl.org/news/secadv/20140605.txt
Dissecting the GnuTLS Bug t347

https://zeek.org/2014/03/06/dissecting-the-gnutls-bug/
Pacemaker t380

https://github.com/Lekensteyn/pacemaker
Security Advisory 3046015: Vulnerability in Schannel Could Allow Security Feature Bypass t386

https://docs.microsoft.com/en-us/security-updates/securityadvisories/2015/3046015
About Security Update 2015-002 t385

https://support.apple.com/en-us/HT204413
GitHub Gist: Temporary RSA 512 Bit Keylife for FREAK attack t388

https://gist.github.com/ValdikSS/f4ba45198fe69c349e9c
About the security content of iOS 8.2 t387

https://support.apple.com/en-us/HT204423
Attack of the week: FREAK (or 'factoring the NSA for fun and profit') t382

https://blog.cryptographyengineering.com/2015/03/attack-of-week-freak-or-factoring-nsa.html
Ticketbleed t381

https://filippo.io/Ticketbleed/
Stop the presses: HTTPS-crippling “FREAK” bug affects Windows after all t384

https://arstechnica.com/security/2015/03/stop-the-presses-https-crippling-freak-bug-affects-windows-after-all/
HTTPS-crippling FREAK exploit affects thousands of Android and iOS apps t383

https://arstechnica.com/security/2015/03/https-crippling-freak-exploit-hits-thousands-of-android-and-ios-apps/
Keys left unchanged in many Heartbleed replacement certificates! t379

https://news.netcraft.com/archives/2014/05/09/keys-left-unchanged-in-many-heartbleed-replacement-certificates.html
Heartbleed hacks hit Mumsnet and Canada’s tax agency t378

https://www.bbc.co.uk/news/technology-27028101
The Results of the CloudFlare Challenge t375

https://blog.cloudflare.com/the-results-of-the-cloudflare-challenge/
300k servers vulnerable to Heartbleed one month later t374

https://blog.erratasec.com/2014/05/300k-servers-vulnerable-to-heartbleed.html#.YT3b8i1Q1Kw
Attackers Exploit the Heartbleed OpenSSL Vulnerability to Circumvent Multi-factor Authentication on VPNs t377

https://web.archive.org/web/20140418233924/https://www.mandiant.com/blog/attackers-exploit-heartbleed-openssl-vulnerability-circumvent-multifactor-authentication-vpns/
Searching for The Prime Suspect: How Heartbleed Leaked Private Keys t376

https://blog.cloudflare.com/searching-for-the-prime-suspect-how-heartbleed-leaked-private-keys/
OpenSSL Project Roadmap t371

https://web.archive.org/web/20150815130657/http://openssl.org/about/roadmap.html
Tech giants, chastened by Heartbleed, finally agree to fund OpenSSL t370

https://arstechnica.com/information-technology/2014/04/tech-giants-chastened-by-heartbleed-finally-agree-to-fund-openssl/
Half a million widely trusted websites vulnerable to Heartbleed bug t373

https://news.netcraft.com/archives/2014/04/08/half-a-million-widely-trusted-websites-vulnerable-to-heartbleed-bug.html
LibreSSL t372

https://www.libressl.org
LittleBlackBox t368

https://code.google.com/archive/p/littleblackbox
Widespread Weak Keys in Network Devices t367

https://factorable.net/
You're Doing IoT RNG t369

https://labs.bishopfox.com/tech-blog/youre-doing-iot-rng
The Logjam Attack t391

https://weakdh.org
A Messy State of the Union: Taming the Composite State Machines of TLS t390

https://www.ieee-security.org/TC/SP2015/papers-archived/6949a535.pdf
One approach to rollback protection t397

https://www.ietf.org/mail-archive/web/tls/current/msg08099.html
Standards work update t396

https://web.archive.org/web/20140301045454/http://my.opera.com/yngve/blog/2012/11/02/standards-work-update
Fwd: New Version Notification for draft-pettersen-tls-version-rollback-removal-00.txt t399

https://www.ietf.org/mail-archive/web/tls/current/msg08889.html
Cipher suite values to indicate TLS capability t398

https://www.ietf.org/mail-archive/web/tls/current/msg08861.html
RFC 6101: The SSL Protocol Version 3.0, Section E.2. t393

https://tools.ietf.org/html/rfc6101#appendix-E.2
Prying Eyes: Inside the NSA's War on Internet Security t392

https://web.archive.org/web/20141228192621/http://www.spiegel.de/international/germany/inside-the-nsa-s-war-on-internet-security-a-1010361.html
Bug #450280: PSM sometimes falls back from TLS to SSL3 when holding F5 (which causes SNI to be disabled) t395

https://bugzilla.mozilla.org/show_bug.cgi?id=450280
RFC 3546: TLS Extensions t394

https://www.ietf.org/rfc/rfc3546.txt
miTLS t389

https://www.mitls.org

8. Protocol Attacks

Extended Random t510

https://projectbullrun.org/dual-ec/ext-rand.html
On the Possibility of a Back Door in the NIST SP800-90 Dual Ec Prng t504

https://rump2007.cr.yp.to/15-shumow.pdf
Revealed: how US and UK spy agencies defeat internet privacy and security t503

https://www.theguardian.com/world/2013/sep/05/nsa-gchq-encryption-codes-security
Exclusive: Secret contract tied NSA and security industry pioneer t506

https://www.reuters.com/article/us-usa-security-rsa-idUSBRE9BJ1C220131220
SUPPLEMENTAL ITL BULLETIN FOR SEPTEMBER 2013 t505

https://csrc.nist.gov/csrc/media/publications/shared/documents/itl-bulletin/itlbul2013-09-supplemental.pdf
robot-detect t500

https://github.com/robotattackorg/robot-detect
Secret Documents Reveal N.S.A. Campaign Against Encryption t502

https://archive.nytimes.com/www.nytimes.com/interactive/2013/09/05/us/documents-reveal-nsa-campaign-against-encryption.html
Raccoon Attack t501

https://raccoon-attack.com
Juniper Breach Mystery Starts to Clear With New Details on Hackers and U.S. Role t508

https://www.bloomberg.com/news/features/2021-09-02/juniper-mystery-attacks-traced-to-pentagon-role-and-chinese-hackers
t507

https://dl.acm.org/doi/10.1145/2976749.2978395
On the Practical Exploitability of Dual EC in TLS Implementations t509

http://dualec.org/
RFC 5746: TLS Renegotiation Indication Extension t421

https://tools.ietf.org/html/rfc5746
My take on the SSL MITM Attacks – part 3 – the FTPS attacks t420

https://blogs.msmvps.com/alunj/2009/11/18/my-take-on-the-ssl-mitm-attacks-part-3-the-ftps-attacks/
TLS/SSLv3 renegotiation vulnerability explained t416

http://www.g-sec.lu/tools.html
Renegotiating TLS t415

https://ww1.prweb.com/prfiles/2009/11/05/104435/RenegotiatingTLS.pdf
Generalization of the TLS Renegotiation Flaw Using HTTP 300 Redirection to Effect Cryptographic Downgrade Attacks t418

https://www.leviathansecurity.com/white-papers/tls-and-ssl-man-in-the-middle-vulnerability/
TLS renegotiation vulnerability: definitely not a full blown MITM, yet more than just a simple CSRF t417

http://www.securegoose.org/2009/11/tls-renegotiation-vulnerability-cve.html
MITM attack on delayed TLS-client auth through renegotiation t414

https://www.ietf.org/mail-archive/web/tls/current/msg03928.html
Redirecting and modifying SMTP mail with TLS session renegotiation attacks t419

http://www.postfix.org/wip.html
Blockwise-Adaptive Attackers: Revisiting the (In)Security of Some Provably Secure Encryption Modes: CBC, GEM, IACBC t441

https://link.springer.com/content/pdf/10.1007%2F3-540-45708-9_2.pdf
Breaking and Provably Repairing the SSH Authenticated Encryption Scheme: A Case Study of the Encode-then-Encrypt-and-MAC Paradigm t440

https://eprint.iacr.org/2002/078.pdf
A Challenging but Feasible Blockwise-Adaptive Chosen-Plaintext Attack on SSL t443

https://eprint.iacr.org/2006/136.pdf
Vulnerability of SSL to Chosen-Plaintext Attack t442

https://eprint.iacr.org/2004/111
An Attack Against SSH2 Protocol t438

http://www.weidai.com/ssh2-attack.txt
Problems with Proposed IP Cryptography t437

https://web.cs.ucdavis.edu/~rogaway/papers/draft-rogaway-ipsec-comments-00.txt
Re: an attack against SSH2 protocol t439

https://www.mail-archive.com/openssl-dev@openssl.org/msg10664.html
Bug #2635: 1/n-1 record splitting technique for CVE-2011-3389 t434

https://marc.info/?l=openssl-dev&m=132008027923646&w=2
NSS 3.13 Release Notes t433

https://groups.google.com/forum/#!msg/mozilla.dev.tech.crypto/KMn9LWX3vVU/-XKglCaGHLcJ
Oracle Java SE Critical Patch Update Advisory - October 2011 t436

https://www.oracle.com/technetwork/topics/security/javacpuoct2011-443431.html
Opera 11.60 for Windows changelog t435

https://web.archive.org/web/20121220094552/http://www.opera.com/docs/changelogs/windows/1160/
Bug #702111: Servers intolerant to 1/n-1 record splitting. "The connection was reset" t430

https://bugzilla.mozilla.org/show_bug.cgi?id=702111
Microsoft Knowledge Base Article 2643584 t432

https://support.microsoft.com/en-us/kb/2643584
Microsoft Security Bulletin MS12-006 t431

https://technet.microsoft.com/library/security/ms12-006
Bug #665814, comment #59: Rizzo/Duong chosen plaintext attack (BEAST) on SSL/TLS 1.0 t427

https://bugzilla.mozilla.org/show_bug.cgi?id=665814#c59
The pitfalls of allowing file uploads on your website t426

https://labs.detectify.com/post/86302927946/the-lesser-known-pitfalls-of-allowing-file-uploads
Apple enabled BEAST mitigations in OS X 10.9 Mavericks t429

https://blog.ivanristic.com/2013/10/apple-enabled-beast-mitigations-in-mavericks.html
BEAST followup t428

https://www.imperialviolet.org/2012/01/15/beastfollowup.html
Re: Call for acceptance of draft-moeller-tls-downgrade-scsv t423

https://www.ietf.org/mail-archive/web/tls/current/msg11270.html
Secure browsing like it's 1995 t422

https://web.archive.org/web/20140302021900/http://my.opera.com/securitygroup/blog/2011/03/17/secure-browsing-like-its-1995
BEAST t425

https://vnhacker.blogspot.co.uk/2011/09/beast.html
Here come the ⊕ Ninjas t424

https://nerdoholic.org/uploads/dergln/beast_part2/ssl_jun21.pdf
Lucky Thirteen: Breaking the TLS and DTLS Record Protocols t463

http://www.isg.rhul.ac.uk/tls/Lucky13.html
CTX: Eliminating BREACH with Context Hiding t462

https://www.blackhat.com/eu-16/briefings.html#ctx-eliminating-breach-with-context-hiding
Padding oracle attack simulation t465

https://erlend.oftedal.no/blog/poet/
Automated Padding Oracle Attacks with PadBuster t464

https://blog.gdssecurity.com/labs/2010/9/14/automated-padding-oracle-attacks-with-padbuster.html
BREACH mitigation t461

https://community.qualys.com/message/20404
breach attack t460

https://mail-archives.apache.org/mod_mbox/httpd-dev/201308.mbox/%3CCAMDeyhwCYYQMK+WTfvge7y20AqEB1=kqMHgqKYhr3kBWkZyYzA@mail.gmail.com%3E
HEIST t459

https://www.blackhat.com/docs/us-16/materials/us-16-VanGoethem-HEIST-HTTP-Encrypted-Information-Can-Be-Stolen-Through-TCP-Windows.pdf
BREACH web site t456

http://breachattack.com/
BREACH: Reviving the CRIME Attack t455

http://breachattack.com/resources/BREACH%20-%20SSL,%20gone%20in%2030%20seconds.pdf
Rupture: A compression side-channel attack framework t458

https://web.archive.org/web/20170710054644/https://ruptureit.com/
BREACH repository t457

https://github.com/nealharris/BREACH
It's not a crime to build a CRIME t452

https://gist.github.com/koto/3696912
CRIME - How to beat the BEAST successor? t451

https://security.stackexchange.com/questions/19911/crime-how-to-beat-the-beast-successor
A Perfect CRIME? TIME Will Tell t454

https://www.blackhat.com/eu-13/briefings.html#Beery
Crack in Internet’s foundation of trust allows HTTPS session hijacking t453

https://arstechnica.com/security/2012/09/crime-hijacks-https-sessions/
New Attack Uses SSL/TLS Information Leak to Hijack HTTPS Sessions t450

https://threatpost.com/new-attack-uses-ssltls-information-leak-hijack-https-sessions-090512/76973/
The CRIME attack t449

http://netifera.com/research/crime/CRIME_ekoparty2012.pdf
Compression contexts and privacy considerations t448

https://groups.google.com/forum/#!msg/spdy-dev/B_ulCnBjSug/rcU-SIFtTKoJ
Compression and Information Leakage of Plaintext t445

https://www.iacr.org/cryptodb/data/paper.php?pubkey=3091
t444

https://src.chromium.org/viewvc/chrome/trunk/src/net/third_party/nss/patches/cbcrandomiv.patch?pathrev=97269
Uncovering Spoken Phrases in Encrypted Voice over IP Conversations t447

https://www.cs.unc.edu/%7Efabian/papers/tissec2010.pdf
Language identification of encrypted VoIP traffic: Alejandra y Roberto or Alice and Bob? t446

https://web.archive.org/web/20080221204234/http://www.cs.jhu.edu/~cwright/voip-vbr.pdf
This POODLE bites: exploiting the SSL 3.0 fallback t485

https://googleonlinesecurity.blogspot.co.uk/2014/10/this-poodle-bites-exploiting-ssl-30.html
TLS Resumption Indication Extension t484

https://datatracker.ietf.org/doc/draft-bhargavan-tls-resumption-indication/
There are more POODLEs in the forest t487

https://yngve.vivaldi.net/there-are-more-poodles-in-the-forest/
Poodle Bites TLS t486

https://blog.ivanristic.com/2014/12/poodle-bites-tls.html
RC4 No More t481

https://www.rc4nomore.com/
Attacking SSL when using RC4 t480

https://web.archive.org/web/20150715235918/http://www.imperva.com/docs/HII_Attacking_SSL_when_using_RC4.pdf
RFC 7627: TLS Session Hash and Extended Master Secret Extension t483

https://datatracker.ietf.org/doc/rfc7627/
Unknown key-share attacks on the station-to-station (STS) protocol t482

https://books.google.co.uk/books?id=cyHE4f0ukbYC&pg=PA154
Statistical Analysis of the Alleged RC4 Keystream Generator t478

https://link.springer.com/content/pdf/10.1007/3-540-44706-7_2.pdf
On the Security of RC4 in TLS and WPA t477

http://www.isg.rhul.ac.uk/tls/
Attacks Only Get Better: Password Recovery Attacks Against RC4 in TLS t479

http://www.isg.rhul.ac.uk/tls/RC4mustdie.html
The ICSI Certificate Notary t474

https://notary.icsi.berkeley.edu/#connection-cipher-details
What's the deal with RC4? t473

https://blog.cryptographyengineering.com/2011/12/whats-deal-with-rc4.html
A Practical Attack on Broadcast RC4 t476

https://web.archive.org/web/20131113041030/http://saluc.engr.uconn.edu/refs/stream_cipher/mantin01attackRC4.pdf
RFC 7465: Prohibiting RC4 Cipher Suites t475

https://tools.ietf.org/html/rfc7465
RFC 7366: Encrypt-then-MAC for TLS and DTLS t470

https://tools.ietf.org/html/rfc7366
RSA Security Response to Weaknesses in Key Scheduling Algorithm of RC4 t472

https://web.archive.org/web/20131001024142/http://www.emc.com/emc-plus/rsa-labs/historical/rsa-security-response-weaknesses-algorithm-rc4.htm
Weaknesses in the Key Scheduling Algorithm of RC4 t471

http://merlot.usc.edu/cs531-s11/papers/Fluhrer01a.pdf
Password Interception in a SSL/TLS Channel t467

https://www.iacr.org/cryptodb/archive/2003/CRYPTO/1069/1069.pdf
Security Flaws Induced by CBC Padding - Applications to SSL, IPSEC, WTLS... t466

https://www.iacr.org/archive/eurocrypt2002/23320530/cbc02_e02d.pdf
Plaintext-Recovery Attacks Against Datagram TLS t469

https://www.isg.rhul.ac.uk/~kp/dtls.pdf
Security of CBC Ciphersuites in SSL/TLS: Problems and Countermeasures t468

https://www.openssl.org/%7Ebodo/tls-cbc.txt
RFC 8017: PKCS #1: RSA Cryptography Specifications Version 2.2 t499

https://tools.ietf.org/html/rfc8017
RFC 7568: Deprecating Secure Sockets Layer Version 3.0 t490

https://tools.ietf.org/html/rfc7568
The ROBOT Attack t496

https://robotattack.org
Chosen Ciphertext Attacks Against Protocols Based on the RSA Encryption Standard PKCS #1 t495

http://archiv.infsec.ethz.ch/education/fs08/secsem/bleichenbacher98.pdf
PKCS #1: RSA Encryption Version 1.5 t498

https://tools.ietf.org/html/rfc2313
The 9 Lives of Bleichenbacher's CAT: New Cache ATtacks on TLS Implementations t497

https://www.nccgroup.com/ae/about-us/newsroom-and-events/blogs/2019/february/downgrade-attack-on-tls-1.3-and-vulnerabilities-in-major-tls-libraries/
Security Losses from Obsolete and Truncated Transcript Hashes t492

https://www.mitls.org/pages/attacks/SLOTH
KCI Attacks against TLS t491

https://kcitls.org
Sweet32: Birthday attacks on 64-bit block ciphers in TLS and OpenVPN t494

https://sweet32.info/
The DROWN Attack t493

https://drownattack.com/
RFC 7507: TLS Fallback SCSV for Preventing Protocol Downgrade Attacks t489

https://tools.ietf.org/html/rfc7507
Zombie POODLE and GOLDENDOODLE Vulnerabilities t488

https://blog.qualys.com/product-tech/2019/04/22/zombie-poodle-and-goldendoodle-vulnerabilities

9. Performance

SSL FalseStart Performance Results t520

https://blog.chromium.org/2011/05/ssl-falsestart-performance-results.html
Fast-Track Session Establishment for TLS t515

https://www.ndss-symposium.org/wp-content/uploads/2017/09/Fast-track-session-establishment-for-TLS.pdf
TLS Snap Start t514

https://datatracker.ietf.org/doc/html/draft-agl-tls-snapstart-00
Building a faster and more secure web with TCP Fast Open, TLS False Start, and TLS 1.3 t517

https://blogs.windows.com/msedgedev/2016/06/15/building-a-faster-and-more-secure-web-with-tcp-fast-open-tls-false-start-and-tls-1-3/
RFC 7413: TCP Fast Open t516

https://datatracker.ietf.org/doc/html/rfc7413
Marissa Mayer at Web 2.0 t511

https://glinden.blogspot.co.uk/2006/11/marissa-mayer-at-web-20.html
Overclocking SSL t513

https://www.imperialviolet.org/2010/06/25/overclocking-ssl.html
Make Data Useful t512

https://speed24.ru/docs/StanfordDataMining.2006-11-28.pdf
Changing HTTPS t519

https://www.imperialviolet.org/2010/09/05/blacklisting.html
The Sad Story of TCP Fast Open t518

https://squeeze.isobar.com/2019/04/11/the-sad-story-of-tcp-fast-open/
Introducing Zero Round Trip Time Resumption t540

https://blog.cloudflare.com/introducing-0-rtt/
High Scalability for SSL and Apache t542

https://awe.com/mark/talks/apachecon2000.pdf
ChaCha20 and Poly1305 for TLS t541

https://www.imperialviolet.org/2013/10/07/chacha20.html
RFC 8879: TLS Certificate Compression t537

https://datatracker.ietf.org/doc/html/rfc8879
An Experimental Study of TLS Forward Secrecy Deployments t536

https://www.linshunghuang.com/papers/ecc-pfs.pdf
TLS 1.3 certificate compression with Brotli t539

https://www.chromestatus.com/feature/5696925844111360
RFC 7924: TLS Cached Information Extension t538

https://datatracker.ietf.org/doc/html/rfc7924
HTTP/3 explained t533

https://http3-explained.haxx.se
RFC 8701: Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility t532

https://datatracker.ietf.org/doc/html/rfc8701
SSL/TLS & Perfect Forward Secrecy t535

https://vincent.bernat.ch/en/blog/2011-ssl-perfect-forward-secrecy
ivanr / ssl-dos t534

https://github.com/ivanr/ssl-dos
Experimenting with QUIC t531

https://blog.chromium.org/2013/06/experimenting-with-quic.html
SPDY t530

https://www.chromium.org/spdy/
RFC 6928: Increasing TCP’s Initial Window t526

https://tools.ietf.org/html/rfc6928
RFC 7918: TLS False Start t525

https://datatracker.ietf.org/doc/html/rfc7918
Slowloris HTTP DoS t528

https://web.archive.org/web/20150315054838/http://ha.ckers.org/slowloris/
Initcwnd settings of major CDN providers t527

https://www.cdnplanet.com/blog/initcwnd-settings-major-cdn-providers/
Re-enable TLS False Start t522

https://bugzilla.mozilla.org/show_bug.cgi?id=942729
False Start's Failure t521

https://www.imperialviolet.org/2012/04/11/falsestart.html
Networking Improvements in IE10 and Windows 8 t524

https://web.archive.org/web/20131221003722/http://blogs.msdn.com/b/ieinternals/archive/2012/08/01/internet-explorer-10-network-performance-improvements-first-available-pre-resolve-pre-connect-caching.aspx
sslTransport.c t523

https://opensource.apple.com/source/Security/Security-55471/libsecurity_ssl/lib/sslTransport.c
SSL_CTX_set_mode(3) t529

https://www.openssl.org/docs/man1.1.1/man3/SSL_CTX_set_mode.html
TLS Client Puzzles Extension t548

https://datatracker.ietf.org/doc/draft-nygren-tls-client-puzzles/
sslsqueeze on GitHub t547

https://github.com/mmgaggle/sslsqueeze
SSL computational DoS mitigation t544

https://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
HTTP2 Expression of Interest t543

https://lists.w3.org/Archives/Public/ietf-http-wg/2012JulSep/0251.html
SSL/TLS and Computational DoS t546

https://web.archive.org/web/20111029201202/http://www.educatedguesswork.org/2011/10/ssltls_and_computational_dos.html
THC SSL DOS t545

https://thehackerschoice.wordpress.com/2011/10/24/thc-ssl-dos/

10. HSTS, CSP, and Pinning

Content Security Policy Level 3 t562

https://www.w3.org/TR/CSP/
Content Security Policy t561

https://web.archive.org/web/20111113230920/http://people.mozilla.org/~bsterne/content-security-policy/
TrustKit for iOS, macOS, tvOS, and watchOS t564

https://github.com/datatheorem/TrustKit
Stop Certificate Pinning t563

https://www.digicert.com/blog/certificate-pinning-what-is-certificate-pinning
Content Restrictions t560

https://www.gerv.net/security/content-restrictions/
Privacy-preserving HSTS t559

https://github.com/whatwg/fetch/issues/920
The Double-Edged Sword of HSTS Persistence and Privacy t558

https://www.leviathansecurity.com/blog/the-double-edged-sword-of-hsts-persistence-and-privacy/
Firefox 4 release notes t555

https://website-archive.mozilla.org/www.mozilla.org/firefox_releasenotes/en-US/firefox/4.0/releasenotes/
Stable Channel Update t554

https://googlechromereleases.blogspot.co.uk/2010/01/stable-channel-update_25.html
Web specifications support in Opera Presto 2.10 t557

https://web.archive.org/web/20120614230636/https://www.opera.com/docs/specs/presto2.10/
HTTP Strict Transport Security comes to Internet Explorer 11 on Windows 8.1 and Windows 7 t556

https://blogs.windows.com/msedgedev/2015/06/09/http-strict-transport-security-comes-to-internet-explorer-11-on-windows-8-1-and-windows-7/
Breaking Out HSTS (and HPKP) on Firefox, IE/Edge and (possibly) Chrome t551

https://business.blogthinkbig.com/breaking-out-hsts-and-hpkp-on-firefox/
Service binding and parameter specification via the DNS t550

https://datatracker.ietf.org/doc/draft-ietf-dnsop-svcb-https/
Bypassing HTTP Strict Transport Security t553

https://www.blackhat.com/docs/eu-14/materials/eu-14-Selvi-Bypassing-HTTP-Strict-Transport-Security-wp.pdf
Analysis of HSTS Caches of Different Browsers t552

https://insinuator.net/2021/05/analysis-of-hsts-caches-of-different-browsers/
ForceHTTPS: Protecting High-Security Web Sites from Network Attacks t549

https://crypto.stanford.edu/forcehttps/forcehttps.pdf
RFC 8627: TLS Server Identity Pinning with Tickets t583

https://datatracker.ietf.org/doc/html/rfc8672
RFC 9102: TLS DNSSEC Chain Extension t580

https://datatracker.ietf.org/doc/rfc9102/
Trust Assertions for Certificate Keys t582

https://tools.ietf.org/html/draft-perrin-tls-tack-02
RFC 7218: Adding Acronyms to Simplify Conversations about DANE t581

https://tools.ietf.org/html/rfc7218
Fixing HPKP with Certificate Constraints t577

https://blog.qualys.com/product-tech/2017/09/19/fixing-hpkp-with-certificate-constraints
Fixing HPKP with Pin Revocation t576

https://blog.qualys.com/product-tech/2017/09/05/fixing-hpkp-with-pin-revocation
DNSSEC authenticated HTTPS in Chrome t579

https://www.imperialviolet.org/2011/06/16/dnssecchrome.html
RFC 6698: The DNS-Based Authentication of Named Entities (DANE) Transport Layer Security (TLS) Protocol: TLSA t578

https://tools.ietf.org/html/rfc6698
Intent To Deprecate And Remove: Public Key Pinning t573

https://groups.google.com/a/chromium.org/g/blink-dev/c/he9tr7p3rZ8/m/eNMwKPmUBAAJ
RFC 7469: Public Key Pinning Extension for HTTP t572

https://datatracker.ietf.org/doc/rfc7469/
Abusing Bleeding Edge Web Standards for AppSec Glory t575

https://www.blackhat.com/docs/us-16/materials/us-16-Zadegan-Abusing-Bleeding-Edge-Web-Standards-For-AppSec-Glory.pdf
Is HTTP Public Key Pinning Dead? t574

https://blog.qualys.com/product-tech/2016/09/06/is-http-public-key-pinning-dead
Enterprise Certificate Pinning t571

https://docs.microsoft.com/en-us/windows/access-protection/enterprise-certificate-pinning
Public key pinning released in Firefox t570

https://blog.mozilla.org/security/2014/09/02/public-key-pinning/
New Man-in-the-Middle attacks leveraging rogue DNS t569

https://blog.phishlabs.com/new-man-in-the-middle-attacks-leveraging-rogue-dns
New Chromium security features, June 2011 t566

https://blog.chromium.org/2011/06/new-chromium-security-features-june.html
TrustKit for Android t565

https://github.com/datatheorem/TrustKit-Android
transport_security_state_static.json t568

https://chromium.googlesource.com/chromium/src/net/+/master/http/transport_security_state_static.json
Public key pinning t567

https://www.imperialviolet.org/2011/05/04/pinning.html

12. OpenSSL Command Line

Win32/Win64 OpenSSL t584

https://slproweb.com/products/Win32OpenSSL.html
Compilation and Installation t586

https://wiki.openssl.org/index.php/Compilation_and_Installation
Apache 2.4 VS16 Windows Binaries and Modules t585

https://www.apachelounge.com/download/
RFC 7919: Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for TLS t595

https://tools.ietf.org/html/rfc7919
Speeding up and Strengthening HTTPS Connections for Chrome on Android t594

https://security.googleblog.com/2014/04/speeding-up-and-strengthening-https.html
OpenSSL CA configuration templates t596

https://github.com/ivanr/bulletproof-tls/tree/master/private-ca
man page t591

https://www.openssl.org/docs/manmaster/man3/SSL_CTX_get_security_level.html
Certificate Transparency in Chrome t590

https://github.com/chromium/ct-policy/blob/master/ct_policy.md
man page t593

https://www.openssl.org/docs/manmaster/man3/SSL_CONF_cmd.html#SUPPORTED-CONFIGURATION-FILE-COMMANDS
man page t592

https://www.openssl.org/docs/manmaster/man5/config.html
Mozilla CA Certificate Store t588

https://www.mozilla.org/en-US/about/governance/policies/security-group/certs/
Hardening t587

https://wiki.debian.org/Hardening
RFC 2985: PKCS #9: Selected Object Classes and Attribute Types Version 2.0 t589

https://tools.ietf.org/html/rfc2985

13. Testing TLS with OpenSSL

New Adventures in DNSSEC and DANE t599

https://www.netmeister.org/blog/dnssec-dane.html
testssl.sh t598

https://testssl.sh
Hardenize t597

https://www.hardenize.com
Bugs in Heartbleed detection scripts t601

https://web.archive.org/web/20140419035209/https://www.hut3.net/blog/cns---networks-security/2014/04/14/bugs-in-heartbleed-detection-scripts-
s_client -reconnect Option Is Broken with TLSv1.3 t600

https://github.com/openssl/openssl/issues/10714