AI
Why Public PKI Has Not Caught Up with TLS
TLS 1.3 was rebuilt from scratch. Let’s Encrypt removed the cost and friction of getting a certificate. Today virtually all web traffic is encrypted. The authentication layer underneath, the part that decides who gets a certificate and for what, remains about as insecure as it was in 2011. There are no technical controls that prevent any of the 94 CA organizations trusted by at least one major browser root store from issuing a certificate for your domain without your knowledge.
The Four Attack Categories That Still Work
Ristic groups the threat surface into four buckets. Active network attacks, DNS spoofing and BGP hijacking, let an attacker intercept CA validation traffic. Infrastructure compromise targets your DNS server directly. Misconfiguration, a dangling DNS record pointing to an IP you no longer control, lets whoever holds that IP collect a certificate. CA compromise is the nuclear option: in 2025 a CA issued 12 certificates for Cloudflare’s 1.1.1.1 without consent. The 2023 Jabber server interception, where a certificate was swapped mid-connection and only discovered when the attacker forgot to renew it, shows state-level actors use these techniques today.
Certificate Transparency as a Discovery and Deterrence Tool
Google forced CT adoption through Chrome: CAs must log every certificate before issuance or Chrome rejects it. Cloudflare Radar now shows roughly 2.5 billion active certificates across dozens of CT logs, with the largest log holding about 3 billion entries. For a defender, the first and easiest win is building a complete list of your domain names, then monitoring the CT stream for suffix matches. That gives you a full subdomain inventory and flags any certificate issued by a CA not on your approved list. Ristic has been processing this stream since 2017.
CAA Records: Restricting Which CAs Can Issue for Your Domains
Certification Authority Authorization is a DNS policy record that tells CAs which ones are permitted to issue for your domain. All CAs must check it. Ristic set his own site to Let’s Encrypt only, immediately eliminating vulnerabilities in every other CA. For higher assurance, a Let’s Encrypt extension lets you restrict issuance to a specific account, so only certificates from your account are permitted. You can also lock down which ACME validation methods are allowed, centralizing issuance to a single DNS-based location. Let’s Encrypt is currently the only CA that implements these account-scoping extensions.
The 10-Step Blueprint for PKI Posture
The first steps are universal: start CT monitoring, build your domain inventory, deploy CAA restricted to your current CAs. Certificate lifetimes shrink to twice-yearly renewal by March next year and monthly renewal by 2029, making automation mandatory now. Post-quantum cryptography requires action today because of store-now-decrypt-later attacks. Later steps are risk-tiered: DNSSEC becomes mandatory for CAs from March 2026; private PKI works well for internal infrastructure and mobile apps with controlled API access; distributed external certificate monitoring detects active interception. Static key pinning in the browser, the approach Google uses and how it caught the DigiNotar compromise, is practical only for organizations whose adversaries include nation-states.
Revocation’s Broken State and the Short-Lived Certificate Fix
No browser enforces standard revocation checking. If someone obtains a misissued certificate for your domain, they can use it for up to a year on average before it expires. The only fast path is convincing the major browsers to add it to their proprietary push-based revocation lists. Short-lived certificates, valid for six to seven days, limit the damage window considerably. By 2029, the mandatory 47-day maximum lifetime will reduce worst-case exposure from a year to about 40 days. That is meaningful progress without solving the underlying revocation problem.
Q&A
How will AI and MCP servers change TLS and PKI? TLS itself is well-positioned; the open problem is post-quantum certificates. The handshake can already be made safe, but certificates still use classical cryptography. Google’s Merkle Tree Certificates project aims to replace the certificate format entirely for web properties. ▶ 41:39
Could multi-perspective certificate monitoring be crowdsourced to make it practical for most organizations? Residential proxy networks already make this achievable cheaply. A check once per hour rotating through 100,000 proxies by region and country is a few days of setup. The harder part is knowing what certificate should be running on a given service so an unexpected change triggers an alert. ▶ 43:43
Will browsers ever verify that a certificate honored CAA at issuance? Unlikely. Only about 50% of clients can even read the HTTPS DNS record, and CAA client checking would add a performance penalty browsers won’t accept. Google’s direction with Merkle Tree Certificates moves away from this approach entirely. Multiple academic studies have found CAs not obeying CAA records; community enforcement remains ongoing. ▶ 45:01
Notable Quotes
the last 15 years have been really great uh for TLS and for encryption generally. Ivan Ristic · ▶ 0:34
there are no technical ways to strictly restrict what CAS can issue any CA issue a certificate for your properties they don’t need permission from you Ivan Ristic · ▶ 6:51
city acts as a deterrence because uh the state actors for example, they know that if they do something in this area, they’ll be detected and they don’t really like to be detected Ivan Ristic · ▶ 25:37
the roation story is a sad one in in our industry for variety of reasons Ivan Ristic · ▶ 34:01
failure is not an option. If you fail, there’s it’s very difficult to come back from this. Ivan Ristic · ▶ 38:21
Key Takeaways
- 94 CA organizations across 42 countries can issue certificates for your domains without your consent.
- CT monitoring gives large organizations their first complete subdomain inventory at no incremental cost.
- CAA with account-scoping on Let’s Encrypt is the strongest publicly available issuance control today.
- Certificate lifetimes drop to 47 days maximum by 2029, making automation non-optional starting now.
- No browser enforces revocation; short-lived certificates are the only practical damage-limiting control.
About the Speaker(s)
Ivan Ristic writes computer security books and builds security products. His book Bulletproof TLS and PKI is widely recognized as the de facto SSL/TLS and PKI reference manual. He founded Hardinize in 2017 as an early adopter of PKI security and certificate transparency monitoring, protecting customer estates through eight years of production experience. Hardinize was acquired by Red Sift in 2022, where Ristic serves as Chief Scientist.