The legitimacy of certification in public-key infrastructure (PKI) is crucial for Internet security. This article discusses recent attacks against certification authorities (CA), revealing two main issues: certificate revocation and certificate authorization. Fundamentally, both issues are rooted in the lack of clear definition on who is authorized to issue or revoke certificates or claim them as valid for any given entity.

The authors examine the strengths and weaknesses of a set of countermeasures proposed in the literature, including (1) PK pinning, which patches a browser with a set of Google-authorized public keys and is not considered as a full-fledged solution; (2) DNS-based authentication of named entities (DANE)/sovereign keys, which depend on domain name system (DNS) security to provide certificate authentication (but DANE itself can easily become an attack target); and 3) perspectives/convergence, which uses a new trust model based on notary servers. However, it fails to defeat attacks against many notaries on a global scale.

None of these approaches solves all security problems. Yet, they are not mutually exclusive, indicating new research directions to combine their advantages.