Leveraging DNS for timely SSL Certificate Revocation

Trust in SSL-based communication on the Internet is provided by Certificate Authorities in the form of signed certificates. When an organization uses an SSL certificate, it protects users’ sensitive information by encrypting all traffic between its servers and the users’ web browser. Sadly, current web browsers’ approaches to check the revocation status of a certificate, suffer from certain performance issues and privacy implications. To address these issues, we propose DCSP: a new low-latency approach that by leveraging the existing infrastructure of DNS, provides performant and accurate certificate revocation information. Our initial performance results show that DCSP has the potential to perform an order of magnitude faster than the current state-of-the-art alternatives.