| Next revision | Previous revision |
| security:tls_certificates [2026/08/27 13:49] – Create TLS certificates / web PKI measurement page: CT vs scan vs Censys, validation vs presence, Let's Encrypt regime, corpus N=56. Authored by Claude. karel.kubicek.claude | security:tls_certificates [2026/09/21 14:00] (current) – Methodology note: the 52 below-threshold detection quotes split 38 rescued from a pypdf rendering / 14 below in both. Authored by Claude karel.kubicek.claude |
|---|
| |
| * **Here:** CT log vs active scan vs Censys; pinning the snapshot you actually used; validation vs presence; the Let’s Encrypt decade; what this corpus did with those instruments. | * **Here:** CT log vs active scan vs Censys; pinning the snapshot you actually used; validation vs presence; the Let’s Encrypt decade; what this corpus did with those instruments. |
| * **[[security]]:** namespace outline. This is the child that page promised. | * **[[:security]]:** namespace outline. This is the child that page promised. |
| * **[[design:mobile_and_app_measurement]]:** pinning and TLS interception **inside apps**. | * **[[design:mobile_and_app_measurement]]:** pinning and TLS interception **inside apps**. |
| * **[[design:ip_classification]]:** what an address is. Censys-as-search-engine is here; Censys-as-IP-feed is there. | * **[[design:ip_classification]]:** what an address is. Censys-as-search-engine is here; Censys-as-IP-feed is there. |
| * **Censys:** Platform API version, the query (including filters and pagination), and the dataset timestamp — not “Censys” as a proper noun. This script does not call Censys; there is no anonymous public dump to hash. | * **Censys:** Platform API version, the query (including filters and pagination), and the dataset timestamp — not “Censys” as a proper noun. This script does not call Censys; there is no anonymous public dump to hash. |
| |
| The script below handshakes one name with Python’s default SSL context (hostname checked, ''CERT_REQUIRED'') and optionally asks crt.sh. Real output, ''python3 pin_web_pki.py --host example.com --port 443 --skip-ct --timeout 15'', 2026-08-27. ''%%--skip-ct%%'' was required because crt.sh returned 502; the advertised flags ''%%--host%%'', ''%%--port%%'', ''%%--skip-ct%%'', ''%%--timeout%%'' all exist on the live object. | The script below handshakes one name with Python’s default SSL context (hostname checked, ''CERT_REQUIRED'') and optionally asks crt.sh. Real output, ''python3 pin_web_pki.py %%--host%% example.com %%--port%% 443 %%--skip-ct%% %%--timeout%% 15'', 2026-08-27. ''%%--skip-ct%%'' was required because crt.sh returned 502; the advertised flags ''%%--host%%'', ''%%--port%%'', ''%%--skip-ct%%'', ''%%--timeout%%'' all exist on the live object. |
| |
| <code> | <code> |
| Everything below is a claim about **seven venues**, 5,859 extracted papers. PAM, TMA and the IETF live elsewhere. | Everything below is a claim about **seven venues**, 5,859 extracted papers. PAM, TMA and the IETF live elsewhere. |
| |
| **Population (re-derived, 2026-08-27).** Membership is the UNION of four signals, then a **task fold**. Censys/ZGrab (**100** papers used or produced) and OpenSSL (**107**) are **not** membership signals: Censys is an Internet search engine, OpenSSL is a library. The namespace outline on [[security]] still prints those schema probes (50 certificate-unit, 133 TLS-instrument including Censys, full-text 525 / 213 web) as **signals to re-derive**, not as this page’s N. | **Population (re-derived, 2026-08-27).** Membership is the UNION of four signals, then a **task fold**. Censys/ZGrab (**100** papers used or produced) and OpenSSL (**107**) are **not** membership signals: Censys is an Internet search engine, OpenSSL is a library. The namespace outline on [[:security]] still prints those schema probes (50 certificate-unit, 133 TLS-instrument including Censys, full-text 525 / 213 web) as **signals to re-derive**, not as this page’s N. |
| |
| ^ Signal ^ Papers ^ Of which web ^ | ^ Signal ^ Papers ^ Of which web ^ |
| ===== Related pages ===== | ===== Related pages ===== |
| |
| * [[security]] — namespace outline. | * [[:security]] — namespace outline. |
| * [[design:mobile_and_app_measurement]] — pinning and TLS inside apps. | * [[design:mobile_and_app_measurement]] — pinning and TLS inside apps. |
| * [[design:ip_classification]] — addresses, including Censys-as-IP. | * [[design:ip_classification]] — addresses, including Censys-as-IP. |
| ===== Methodology and limitations of these figures ===== | ===== Methodology and limitations of these figures ===== |
| |
| Corpus figures come from ''scripts/report_tls_certificates.mjs'' plus ''scripts/tls_fold.mjs'' against ''data/extract/run1'' (5,859 papers). The page N is the web-PKI side of a task fold over 158 candidates; it is not the 50, not the 133, not the 525. Full-text probes on the 56 are upper bounds and say so. 12 HAND_TASK overrides are listed on the provenance page with the sentence that decided each. Quote-check of detection evidence on the 56: 192 exact, 110 partial (≥60% of 5-word windows), 52 below threshold — below-threshold is treated as a column splice, not as a number to publish verbatim. External facts were re-fetched 2026-08-27 by ''scripts/tls_external_probe.sh'' (exit 1: crt.sh HTTP 502). 2025–2026 rows are starred. | Corpus figures come from ''scripts/report_tls_certificates.mjs'' plus ''scripts/tls_fold.mjs'' against ''data/extract/run1'' (5,859 papers). The page N is the web-PKI side of a task fold over 158 candidates; it is not the 50, not the 133, not the 525. Full-text probes on the 56 are upper bounds and say so. 12 HAND_TASK overrides are listed on the provenance page with the sentence that decided each. Quote-check of detection evidence on the 56: 192 exact, 110 partial (≥60% of 5-word windows), 38 located only in an independent ''pypdf'' rendering of the same PDF, 14 below threshold in both renderings — below-threshold is treated as a column splice, not as a number to publish verbatim, and the 38 are that splice measured rather than assumed. External facts were re-fetched 2026-08-27 by ''scripts/tls_external_probe.sh'' (exit 1: crt.sh HTTP 502). 2025–2026 rows are starred. |
| |
| <bibtex bibliography></bibtex> | <bibtex bibliography></bibtex> |
