You are about to measure HTTPS, certificates, or Certificate Transparency on the public web. This page is about which instrument answers which question, what “valid” meant in the papers you will cite, and how the Let’s Encrypt decade changed the base rate. It is not a cryptography tutorial. It is not mobile certificate pinning — that is mobile_and_app_measurement. It is not “Censys as an IP classifier” — that residue sits on ip_classification.

The numbers below are paper counts from this site’s seven-venue corpus (CCS, IMC, NDSS, PETS, USENIX Security, TheWebConf, IEEE S&P, 2010–2026, 5,859 extracted papers) unless a sentence names a different source. 2025–2026 venue-years are provisional.

• Here: CT log vs active scan vs Censys; pinning the snapshot you actually used; validation vs presence; the Let’s Encrypt decade; what this corpus did with those instruments.
• security: namespace outline. This is the child that page promised.
• mobile_and_app_measurement: pinning and TLS interception inside apps.
• ip_classification: what an address is. Censys-as-search-engine is here; Censys-as-IP-feed is there.
• website_selection / tranco: the name list you handshake, which is a sampling decision this page does not re-litigate.

• [2Holz, Ralph; Braun, Lothar; Kammenhuber, Nils; Carle, Georg (2011): "The SSL landscape: a thorough analysis of the X.509 PKI using active and passive measurements", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — IMC 2011. Active plus passive, and the 18.07% absolute-validity figure. The founding web-PKI measurement; the extractor’s population.unit == certificates misses it (unit is websites).
• [4Durumeric, Zakir; Kasten, James; Bailey, Michael D.; Halderman, J. Alex (2013): "Analysis of the HTTPS certificate ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — IMC 2013. 42.4 million distinct certificates from 108.8 million addresses; 1,832 signing certificates at 683 organisations.
• [1VanderSloot, Benjamin; Amann, Johanna; Bernhard, Matthew; Durumeric, Zakir; Bailey, Michael D.; Halderman, J. Alex (2016): "Towards a Complete View of the Certificate Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — IMC 2016. The completeness paper: what CT sees that scanning does not, and the reverse.
• [5Felt, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa (2017): "Measuring HTTPS Adoption on the Web", in: Proceedings of the USENIX Security Symposium. (Link)] — USENIX Security 2017. HTTPS adoption (browser, site, network), not just certificates on port 443. February 2017: 40% of the Alexa Million supported HTTPS, 10% by default.
• [6Kotzias, Platon; Razaghpanah, Abbas; Amann, Johanna; Paterson, Kenneth G.; Vallina-Rodriguez, Narseo; Caballero, Juan (2018): "Coming of Age: A Longitudinal Study of TLS Deployment", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — IMC 2018. Six years of TLS deployment (versions, ciphers), not a certificate census. TLS 1.3 advertised in 23.6% of connections in April 2018 and successfully negotiated in 1.3%.
• [7Durumeric, Zakir; Adrian, David; Mirian, Ariana; Bailey, Michael D.; Halderman, J. Alex (2015): "A Search Engine Backed by Internet-Wide Scanning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] — CCS 2015. Censys the instrument.
• [3Aas, Josh; Barnes, Richard; Case, Benton; Durumeric, Zakir; Eckersley, Peter; Flores-López, Alan; Halderman, J. Alex; Hoffman-Andrews, Jacob; Kasten, James; Rescorla, Eric; Schoen, Seth D.; Warren, Brad (2019): "Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] — CCS 2019. Let’s Encrypt as an automated CA, with dated market-share figures.
• [8Durumeric, Zakir; Adrian, David; Stephens, Phillip; Wustrow, Eric; Halderman, J. Alex (2024): "Ten Years of ZMap", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] — IMC 2024. Ten years of ZMap; the scanner is still the scanner.

Pick the instrument for the claim, then pin it. Mixing them in one sentence (“we scanned CT with Censys”) is how a methods section becomes unreproducible.

VanderSloot et al. [1VanderSloot, Benjamin; Amann, Johanna; Bernhard, Matthew; Durumeric, Zakir; Bailey, Michael D.; Halderman, J. Alex (2016): "Towards a Complete View of the Certificate Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the paper that measured those rows rather than asserting them:

Combining data from Censys and CT covers 99.4% of all trusted certificates seen by any perspective we studied

and still, of certificates seen in a zone-file crawl:

they still miss 1.5% of certificates observed in a crawl of all domains in .com, .net, and .org.

Scheitle et al. [9Scheitle, Quirin; Gasser, Oliver; Nolte, Theodor; Amann, Johanna; Brent, Lexi; Carle, Georg; Holz, Ralph; Schmidt, Thomas C.; Wählisch, Matthias (2018): "The Rise of Certificate Transparency and Its Implications on the Internet Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] then measured CT as a deployment and as a leak: by IMC 2018, a third of established connections carried CT evidence, and CT honeypots saw third-party scans shortly after issuance. A 2018 adoption fraction is not a 2026 one. Chrome’s log policy still admits logs that speak RFC 6962 or static-ct-api v1.1.0 (tiled logs); RFC 9162 (CT 2.0) is Experimental.²⁾ Chrome log_list.json v3 on 2026-08-27 was version 89.31, timestamp 2026-08-26T13:37:57Z: 8 operators; 26 RFC-6962 logs (21 usable, 2 readonly, 3 retired); 22 tiled logs (6 qualified, 16 usable).³⁾

Censys in 2026 is the Platform API, base https://api.platform.censys.io/v3/, authenticated with a Personal Access Token. The transition guide was last modified 2026-05-08.⁴⁾ Legacy Search at search.censys.io still has DNS; from this host it answers HTTP 403 (WAF) to both this wiki’s User-Agent and a stock Mozilla UA. Do not pin a 2026 study to the 2015 Censys search syntax without saying you used Legacy Search, and do not call the Platform a drop-in for Durumeric et al. [7Durumeric, Zakir; Adrian, David; Mirian, Ariana; Bailey, Michael D.; Halderman, J. Alex (2015): "A Search Engine Backed by Internet-Wide Scanning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)].

Of the 56 papers on this page, 22 have a certificates-unit tuple in the extraction; 12 of those 22 (54.5%) state a listVersion. The other 34 papers in the population measured TLS without a certificates-unit tuple at all (Holz, Kotzias, Censys, ZMap’s tenth year, …). Full-text mention of a snapshot or dataset date is 12 of 56 (21.4%) — an upper bound, not a census of pinning.

What to write down:

• CT: Chrome log-list version and log_list_timestamp identify which logs were Qualified/Usable, not the bytes inside them. Pin the query (crt.sh parameters and the SHA-256 of the JSON you stored) or a log ID plus a tree head / archived prefix. A log-list pin alone is not a CT dataset. The public landing page moved: certificate-transparency.org HTTP 301 to https://certificate.transparency.dev/ (followed, 2026-08-27).
• Active scan: ZMap/ZGrab versions, the hit-rate options you enabled [8Durumeric, Zakir; Adrian, David; Stephens, Phillip; Wustrow, Eric; Halderman, J. Alex (2024): "Ten Years of ZMap", in: Proceedings of the ACM Internet Measurement Conference. (DOI)], the vantage, the date, and whether you verified chains.
• Censys: Platform API version, the query (including filters and pagination), and the dataset timestamp — not “Censys” as a proper noun. This script does not call Censys; there is no anonymous public dump to hash.

The script below handshakes one name with Python’s default SSL context (hostname checked, CERT_REQUIRED) and optionally asks crt.sh. Real output, python3 pin_web_pki.py –host example.com –port 443 –skip-ct –timeout 15, 2026-08-27. --skip-ct was required because crt.sh returned 502; the advertised flags --host, --port, --skip-ct, --timeout all exist on the live object.

Live TLS handshake to example.com:443 on 2026-08-27T13:46:44Z (Python ssl, default context, hostname checked); leaf SHA-256 6153a96fd1a6ab7f4d438fc34932484299d0729d9140b3a126bb2f9c07b02200; issuer countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 3; notAfter Oct 27 22:17:21 2026 GMT; validated=True; Python 3.11.2; OpenSSL 3.0.20 7 Apr 2026.
wrote /workspace/artifacts/wiki/pages/pin_web_pki.manifest.json
live sha256 6153a96fd1a6ab7f4d438fc34932484299d0729d9140b3a126bb2f9c07b02200
live issuer countryName=US, organizationName=SSL Corporation, commonName=Cloudflare TLS Issuing ECC CA 3
live notAfter Oct 27 22:17:21 2026 GMT
tls TLSv1.3 cipher TLS_AES_256_GCM_SHA384

That leaf is a Cloudflare-fronted example.com (issuer Cloudflare TLS Issuing ECC CA 3, SAN example.com and *.example.com, TLSv1.3, TLS_AES_256_GCM_SHA384). validated=True means this Python, this host, this default context, this instant accepted the chain. It is not “the web PKI says this name is valid” and it is not a CT observation.

pin_web_pki.py

#!/usr/bin/env python3
"""Pin what a TLS measurement actually saw: the live handshake and (optionally)
what Certificate Transparency has for the same name.
 
    python3 pin_web_pki.py
    python3 pin_web_pki.py --host example.com
    python3 pin_web_pki.py --host example.com --port 443
    python3 pin_web_pki.py --host example.com --skip-ct
    python3 pin_web_pki.py --timeout 30
 
Writes pin_web_pki.manifest.json next to the script. The manifest's `cite`
line is the thing to put in a methods section.
 
This does not talk to Censys: the Platform API needs a Personal Access Token
and a paid-or-free-tier account. Pin a Censys snapshot by its dataset date
from the Platform UI, not from this script.
"""
from __future__ import annotations
 
import argparse
import hashlib
import json
import socket
import ssl
import sys
import urllib.error
import urllib.parse
import urllib.request
from datetime import datetime, timezone
 
UA = "measuretheweb-pin-web-pki/1.0"
CRTSH = "https://crt.sh/?q={q}&output=json"
 
 
def utc_now() -> str:
    return datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
 
 
def sha256_hex(der: bytes) -> str:
    return hashlib.sha256(der).hexdigest()
 
 
def handshake(host: str, port: int, timeout: float) -> dict:
    ctx = ssl.create_default_context()
    ctx.check_hostname = True
    ctx.verify_mode = ssl.CERT_REQUIRED
    with socket.create_connection((host, port), timeout=timeout) as sock:
        with ctx.wrap_socket(sock, server_hostname=host) as ssock:
            der = ssock.getpeercert(binary_form=True)
            decoded = ssock.getpeercert()
            cipher = ssock.cipher()
            version = ssock.version()
    if der is None:
        raise RuntimeError(f"handshake with {host}:{port} returned no peer certificate")
    if decoded is None:
        raise RuntimeError(f"handshake with {host}:{port} returned an undecoded peer certificate")
    san = []
    for kind, value in decoded["subjectAltName"]:
        san.append(f"{kind}:{value}")
    subject = ", ".join(f"{k}={v}" for rdn in decoded["subject"] for k, v in rdn)
    issuer = ", ".join(f"{k}={v}" for rdn in decoded["issuer"] for k, v in rdn)
    return {
        "host": host,
        "port": port,
        "tls_version": version,
        "cipher": cipher[0],
        "subject": subject,
        "issuer": issuer,
        "notBefore": decoded["notBefore"],
        "notAfter": decoded["notAfter"],
        "san": san,
        "sha256": sha256_hex(der),
        "der_bytes": len(der),
        "validated": True,
        "python": sys.version.split()[0],
        "openssl": ssl.OPENSSL_VERSION,
    }
 
 
def crtsh(query: str, timeout: float) -> list:
    url = CRTSH.format(q=urllib.parse.quote(query))
    req = urllib.request.Request(url, headers={"User-Agent": UA})
    try:
        with urllib.request.urlopen(req, timeout=timeout) as resp:
            raw = resp.read()
    except urllib.error.HTTPError as e:
        raise RuntimeError(f"crt.sh query {url} returned HTTP {e.code} {e.reason}") from e
    except urllib.error.URLError as e:
        raise RuntimeError(f"crt.sh query {url} failed: {e}") from e
    rows = json.loads(raw.decode())
    return rows
 
 
def main() -> int:
    ap = argparse.ArgumentParser(description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter)
    ap.add_argument("--host", default="example.com", help="hostname to handshake (default example.com)")
    ap.add_argument("--port", type=int, default=443)
    ap.add_argument("--skip-ct", action="store_true", help="skip the crt.sh lookup")
    ap.add_argument("--timeout", type=float, default=30.0)
    args = ap.parse_args()
 
    fetched_at = utc_now()
    live = handshake(args.host, args.port, args.timeout)
    ct_n = None
    ct_has_live = None
    ct_max_not_after = None
    if not args.skip_ct:
        rows = crtsh(args.host, args.timeout)
        ct_n = len(rows)
        live_fp = live["sha256"]
        by_fp = crtsh(live_fp, args.timeout)
        ct_has_live = len(by_fp) > 0
        if len(rows) == 0:
            ct_max_not_after = None
        else:
            newest = rows[0]
            for row in rows[1:]:
                if row["not_after"] > newest["not_after"]:
                    newest = row
            ct_max_not_after = {
                "id": newest["id"],
                "issuer": newest["issuer_name"],
                "not_after": newest["not_after"],
                "name_value": newest["name_value"],
                "note": "row with maximum not_after among the query results, not newest issuance",
            }
 
    cite = (
        f"Live TLS handshake to {args.host}:{args.port} on {fetched_at} "
        f"(Python ssl, default context, hostname checked); "
        f"leaf SHA-256 {live['sha256']}; issuer {live['issuer']}; notAfter {live['notAfter']}; "
        f"validated={live['validated']}; Python {live['python']}; {live['openssl']}."
    )
    if ct_n is not None:
        cite += f" crt.sh JSON for q={args.host} returned {ct_n} rows"
        if ct_has_live:
            cite += "; live leaf SHA-256 present in crt.sh."
        else:
            cite += "; live leaf SHA-256 not found in crt.sh (query by fingerprint returned 0 rows)."
 
    manifest = {
        "fetched_at": fetched_at,
        "live": live,
        "ct_row_count": ct_n,
        "ct_has_live_sha256": ct_has_live,
        "ct_max_not_after": ct_max_not_after,
        "cite": cite,
    }
    out_path = __file__.replace("pin_web_pki.py", "pin_web_pki.manifest.json")
    with open(out_path, "w", encoding="utf-8") as f:
        json.dump(manifest, f, indent=2)
        f.write("\n")
 
    print(cite)
    print(f"wrote {out_path}")
    print(f"live sha256 {live['sha256']}")
    print(f"live issuer {live['issuer']}")
    print(f"live notAfter {live['notAfter']}")
    print(f"tls {live['tls_version']} cipher {live['cipher']}")
    if ct_n is not None:
        print(f"crt.sh rows {ct_n} live_sha256_in_ct {ct_has_live}")
    return 0
 
 
if __name__ == "__main__":
    sys.exit(main())

Holz et al. [2Holz, Ralph; Braun, Lothar; Kammenhuber, Nils; Carle, Georg (2011): "The SSL landscape: a thorough analysis of the X.509 PKI using active and passive measurements", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] is the paper to steal the distinction from, not a 2011 prevalence to paste into 2026 related work.

Two thirds of all queried hosts offer TLS/SSL on port 443, and more than 90% of the top 1,000 do so, too.

That is presence. Then hostname-and-chain:

This corresponds to just 18.07% of all certificates.

SNI did not rescue it (18.09% with SNI in the same campaign). Trust-chain validity alone was about 60% in the active scans. The gap between “speaks TLS” and “a browser would accept this” is the measurement.

Felt et al. [5Felt, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa (2017): "Measuring HTTPS Adoption on the Web", in: Proceedings of the USENIX Security Symposium. (Link)] made the same distinction on the site side in February 2017:

only 40% support HTTPS (10% by default)

Support and default-on are different adoption claims. Durumeric et al. [4Durumeric, Zakir; Kasten, James; Bailey, Michael D.; Halderman, J. Alex (2013): "Analysis of the HTTPS certificate ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)] counted 42.4 million distinct certificates from 108.8 million addresses, and 12.7% of hosts serving once-valid browser-trusted leaves as misconfigured — a configuration finding, not a “HTTPS is 12.7% broken” headline. Huang et al. [10Huang, Lin-Shung; Rice, Alex; Ellingsen, Erling; Jackson, Collin (2014): "Analyzing Forged SSL Certificates in the Wild", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)] measured forged certificates in the wild (interception), which is a third question again.

In this page’s population, a full-text probe for validation/verify/valid-chain hits 32 of 56 (57.1%); for port-443 / handshake-only presence 22 of 56 (39.3%); for a named root store 46 of 56 (82.1%). Those are upper bounds: a paper that mentions validation is not a paper that validated. SNI is mentioned in 18 of 56 (32.1%).

Let’s Encrypt’s first publicly-trusted certificate went live on 14 September 2015.⁵⁾ Cite Aas et al. [3Aas, Josh; Barnes, Richard; Case, Benton; Durumeric, Zakir; Eckersley, Peter; Flores-López, Alan; Halderman, J. Alex; Hoffman-Andrews, Jacob; Kasten, James; Rescorla, Eric; Schoen, Seth D.; Warren, Brad (2019): "Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)] for the 2019 measurement, not for 2026:

It was used by about 35% of top million sites with HTTPS as of January 2019.

and, on 21 January 2019, 91M unexpired Let’s Encrypt certificates valid for 155M unique FQDNs.

What moved after that, from Let’s Encrypt’s own posts (not from this corpus):

• Late September 2025: more than ten million certificates issued in a day, and “frequently” that rate as of the 10-year post.
• Firefox HTTPS: global percentage from below 30% to around 80%, “where it’s remained ever since”; US close to 95%.
• EOY letter 2025-12-29: websites served 492 million → 762 million in 2025 (50% in one year).⁶⁾
• letsencrypt.org/stats/ last updated August 18, 2026 — charts, few raw numbers you can cite without reading the image.

Of this page’s 56 papers, 14 are 2010–2015 (before / first year of LE), 25 are 2016–2019, 11 are 2020–2024, 6 are 2025–2026*. Full-text “Let’s Encrypt” in the page population: 33 of 56 (58.9%), an upper bound.

A 2013 HTTPS-ecosystem paper and a 2025 issuance-check paper are not the same instrument environment. Say so.

Everything below is a claim about seven venues, 5,859 extracted papers. PAM, TMA and the IETF live elsewhere.

Population (re-derived, 2026-08-27). Membership is the UNION of four signals, then a task fold. Censys/ZGrab (100 papers used or produced) and OpenSSL (107) are not membership signals: Censys is an Internet search engine, OpenSSL is a library. The namespace outline on security still prints those schema probes (50 certificate-unit, 133 TLS-instrument including Censys, full-text 525 / 213 web) as signals to re-derive, not as this page’s N.

The full-text 525 / 213 is an upper bound. 4 of 5,859 records have no paper.cols.txt and count as negatives.

The task fold then drops RPKI, code-signing, S/MIME, IoT, mobile-client pinning, client-library verification, crypto-not-web-PKI, CT-as-a-phishing-feed, and a not-pki bucket (campus mTLS, PCI “certification”, Johnny-can’t-revoke-consent, location-heartbleeding, …). Residue after 12 keyed overrides is 0. 102 candidates are off this page’s topic; 56 remain (35.4% of 158).

Of those 56: 37 web platform, 6 crawled, 44 network-scan-or-probe. This is scan literature, not a crawler page. Three posters (5.4%).

IMC is the venue. If you are submitting HTTPS measurement to USENIX Security, the methods literature you need is still mostly IMC.

Folded TLS-ish used/produced tool names on the 56 (not Firefox, not Nginx). 37 of 56 papers name at least one. Residue of that fold: 0 strings.

Censys ∩ page population is 11 papers (used/produced Censys/ZGrab, and in the 56). Full-text Censys on the 56 is 21 (37.5%) — again an upper bound. Live tool versions, 2026-08-27: sslyze 6.3.1 on PyPI; zmap/zmap not archived, pushed_at 2026-08-26; zmap/zgrab2 not archived, pushed_at 2026-07-27; testssl/testssl.sh not archived, pushed_at 2026-08-24.

A methods section a later scan can reconstruct:

• Which instrument, in the table’s language: issuance (CT), live service (scan), or a named Censys snapshot — not “we measured TLS”.
• Validation or presence. If you verified, name the root store and the time. If you counted port 443, say so.
• The snapshot. Chrome log-list version + log_list_timestamp (necessary, not sufficient for CT data); ZMap/ZGrab versions and scan date; Censys dataset timestamp and the query. The 12/22 listVersion rate is the reporting rate in this page’s 56-paper population, not a property of the field at large.
• SNI, IPv6, and the name list. A Tranco id is a sampling pin (tranco); an IPv4-wide scan is a different population [1VanderSloot, Benjamin; Amann, Johanna; Bernhard, Matthew; Durumeric, Zakir; Bailey, Michael D.; Halderman, J. Alex (2016): "Towards a Complete View of the Certificate Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)].
• The LE year. “We crawled HTTPS in 2014” and “we crawled HTTPS in 2024” are not comparable adoption claims.
• Ethics of scanning live hosts already lives on ethics; telling the operator on notifying_websites. Do not invent a third copy.

• security — namespace outline.
• mobile_and_app_measurement — pinning and TLS inside apps.
• ip_classification — addresses, including Censys-as-IP.
• tranco / website_selection — the name list.
• ethics / notifying_websites — scanning live sites.
• corpus — funnel and the 2025–2026 edge.
• tls_certificates — queries, fold, residue, quote check, live probes.

Corpus figures come from scripts/report_tls_certificates.mjs plus scripts/tls_fold.mjs against data/extract/run1 (5,859 papers). The page N is the web-PKI side of a task fold over 158 candidates; it is not the 50, not the 133, not the 525. Full-text probes on the 56 are upper bounds and say so. 12 HAND_TASK overrides are listed on the provenance page with the sentence that decided each. Quote-check of detection evidence on the 56: 192 exact, 110 partial (≥60% of 5-word windows), 52 below threshold — below-threshold is treated as a column splice, not as a number to publish verbatim. External facts were re-fetched 2026-08-27 by scripts/tls_external_probe.sh (exit 1: crt.sh HTTP 502). 2025–2026 rows are starred.

[1]

VanderSloot, Benjamin; Amann, Johanna; Bernhard, Matthew; Durumeric, Zakir; Bailey, Michael D.; Halderman, J. Alex (2016): "Towards a Complete View of the Certificate Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[2]

Holz, Ralph; Braun, Lothar; Kammenhuber, Nils; Carle, Georg (2011): "The SSL landscape: a thorough analysis of the X.509 PKI using active and passive measurements", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[3]

Aas, Josh; Barnes, Richard; Case, Benton; Durumeric, Zakir; Eckersley, Peter; Flores-López, Alan; Halderman, J. Alex; Hoffman-Andrews, Jacob; Kasten, James; Rescorla, Eric; Schoen, Seth D.; Warren, Brad (2019): "Let's Encrypt: An Automated Certificate Authority to Encrypt the Entire Web", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[4]

Durumeric, Zakir; Kasten, James; Bailey, Michael D.; Halderman, J. Alex (2013): "Analysis of the HTTPS certificate ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[5]

Felt, Adrienne Porter; Barnes, Richard; King, April; Palmer, Chris; Bentzel, Chris; Tabriz, Parisa (2017): "Measuring HTTPS Adoption on the Web", in: Proceedings of the USENIX Security Symposium. (Link)

[6]

Kotzias, Platon; Razaghpanah, Abbas; Amann, Johanna; Paterson, Kenneth G.; Vallina-Rodriguez, Narseo; Caballero, Juan (2018): "Coming of Age: A Longitudinal Study of TLS Deployment", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[7]

Durumeric, Zakir; Adrian, David; Mirian, Ariana; Bailey, Michael D.; Halderman, J. Alex (2015): "A Search Engine Backed by Internet-Wide Scanning", in: Proceedings of the ACM SIGSAC Conference on Computer and Communications Security. (DOI)

[8]

Durumeric, Zakir; Adrian, David; Stephens, Phillip; Wustrow, Eric; Halderman, J. Alex (2024): "Ten Years of ZMap", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[9]

Scheitle, Quirin; Gasser, Oliver; Nolte, Theodor; Amann, Johanna; Brent, Lexi; Carle, Georg; Holz, Ralph; Schmidt, Thomas C.; Wählisch, Matthias (2018): "The Rise of Certificate Transparency and Its Implications on the Internet Ecosystem", in: Proceedings of the ACM Internet Measurement Conference. (DOI)

[10]

Huang, Lin-Shung; Rice, Alex; Ellingsen, Erling; Jackson, Collin (2014): "Analyzing Forged SSL Certificates in the Wild", in: Proceedings of the IEEE Symposium on Security and Privacy. (DOI)