An Automatic Large-scale Tool for X.509v3 Certificate Collection and Analysis

Since its introduction in the 1970s, public key cryptography has undergone many changes and updates to meet security, usability, and efficiency. Public-key certificates are important to create trust in the public keys, but they can also be exploited as attack vectors in cyberattacks. To effectively combat the threats associated with the Web Public Key Infrastructure (PKI), it is essential to employ tools or platforms capable of swiftly gathering and thoroughly analyzing large volumes of certificates, including, but not limited to, web domains across defined geographic regions, countries, or pertaining to specific application domains. We introduce DigitalCertiAnalytics, a tool for collecting and analyzing X.509v3 certificates used in the Web PKI. DigitalCertiAnalytics incorporates software tools that may carry out partial analyses, such as Zgrab2 for certificate collection, Zlint for certificate format validation, and SSLyze for certificate chain verification. We validated the proposed tool by examining over 10 million web domains in two lists, containing the most visited web domains in different geographical regions. DigitalCertiAnalytics is accurate, flexible, and fast, making it a useful tool for attack prevention, where early detection of invalid, malformed, or erroneous certificates helps to identify attacks in the early stage.