As of today, TLS is the most commonly used protocol to protect communication content. To provide good security, it is of central importance, that administrators know how to configure their services correctly. For this purpose, services like, e.g., Qualys SSL Server Test can be leveraged to test the correctness of a given web server configuration. We analyzed the utilization of this service over a period of 2.5 months and found two major usage-patterns. In addition, there is a relation between the number of test-runs and the resulting quality (i.e., security) of a TLS configuration.
@article{arxiv.1809.08817,
title = {The Struggle is Real: Analyzing Ground Truth Data of TLS (Mis-)Configurations},
author = {Christian Tiefenau and Emanuel von Zezschwitz},
journal= {arXiv preprint arXiv:1809.08817},
year = {2018}
}
Comments
Poster presented at the 14th Symposium on Usable Privacy and Security (SOUPS 2018)