DomainPKI
Xinli Wang, Mostafa El-Said · 2020
Certificate Authority (CA) is a single point of failure in the trust model of X.509 Public Key Infrastructure (PKI), since CA is the only entity to sign and distribute public key certificates and no one else is involved in certificate verification. In response, recent fixes based on public logs have been successful in making certificate management more transparent and publicly verifiable. However, more recent researches have shown that none of existing solutions is fully satisfactory due to different security flaws and operational challenges. In this study, we propose a domain-aware alternative to mitigate those issues by involving domain owner in digital signature and certificate verification.