Certificates-as-an-Insurance: Incentivizing Accountability in SSL/TLS

We propose to leverage accountability mechanisms to deal with trust-related security incidents of certification authorities (CAs) in the SSL/TLS public-key infrastructure (PKI). We argue that, despite recent advances in securing certificate issuance and verification, the TLS PKI does not sufficiently incentivize careful identity verification by CAs during certificate issuance or provide CA accountability in the event of a certificate compromise. We propose a new paradigm, Certificates-as-anInsurance, to hold CAs accountable for misbehavior by using insurance policies and benefits negotiated between the CA and the domain. In this positional paper, we only sketch an instantiation of our insurance model as an extension of the existing certification model and identify challenges for future research.