Carleton University - School of Computer Science Honours Project
Fall 2019
Internet Adoption of Proxy Certificates
Tyler Despatie
SCS Honours Project Image
ABSTRACT
The goal of this project is to implement the acceptance of Proxy Certificates into the Chromium web browser to later result in wide-spread adoption. Proxy Certificates are a proposed solution to address revocation and delegation shortcomings in Public Key Infrastructure (PKI), while offering two additional security policies. Domain owners may issue Proxy Certificates if they hold a non-CA certificate and these certificates may grant all or a subset of their privileges to other entities without requiring trust on first use (TOFU). The lifetime of these certificates can be arbitrarily short, which may provide additional security against key compromise. Content delivery networks (CDNs) stand to benefit the most in this model as they need not resort to key-sharing; they can employ a certificate server within their network to generate proxy certificates upon expiry without requiring the private key to be accessible to their edge servers. Proxy Certificates are served as a regular certificate as an extension of the chain of trust, and their issuance is conducted using OpenSSL. This report documents the modifications made to Chromium’s codebase to handle their validation; full implementation efforts remain ongoing due to technical limitations.