Podcast
Root Causes 388: What Is the WebPKI?


Hosted by
Tim Callan
Chief Compliance Officer
Jason Soroko
Fellow
Original broadcast date
May 22, 2024
These days we frequently discuss "the WebPKI." But what does that really mean? In this episode we define the term and explain how this definition evolved over time. We give an inventory of a main components of the WebPKI and discuss what's required to become a CA.
Podcast Transcript
Lightly edited for flow and brevity.
So what I mean today, and in a way, the WebPKI is a bit of a misnomer now. And we'll get to that. What I mean today, when I say or - - let’s do it the other way. What would I have meant ten years ago? Ten years ago, if you said to me, what is the WebPKI, I would have said, that's real simple. That is the full body and corpus of the public root SSL certificates that are issued in the world, and the surrounding infrastructure, procedures, rules and ecosystems that make them possible and reliable. That would have been my definition a decade ago, I just made that up. But I think it's pretty good. I can stick with that. And that's still true today. But the WebPKI, in my definition today has expanded and it includes, first of all, a broader set of supporting structures, for instance, certificate transparency, and certificate transparency tools, and things that just didn't exist then. But in addition to that, it really has expanded its footprint to many more types of certificates, really to damn near any certificate that sits on a public root. So nowadays, we would consider an S/MIME cert or a client certificate or a code signing certificate or a document signing certificate. As long as it was sitting on a public root that was used in the general public root stores, I would lump that into the WebPKI.
Which is a small minority of how SSL certs are used today. And the second component of it or element of it was that, you know, it was only SSL, right? Like there was no sense of saying, well, we need to consider code signing, or S/MIME as part of this single system with similar expectations and similar rules and similar processes. None of that was there at the time. The maturation just wasn't there yet.
Because you can't get a cert really without that domain. Now there's, many examples now where you can but back in the day, that's how it started. A cert and a domain were kind of like peanut butter and jelly. They went together. But what you needed as part of that infrastructure was you needed the browser, and you needed a browser that trusted a Certificate Authority and then you needed subscribers. Right? Who were actually going off and getting those certificates, Tim, and then things started to get more complicated from there.
And then, of course, we had the CA/Browser Forum, right?
And also around clustering around the CAs is also the concept of validation. Right? And also, revocation technologies, CRLs, OCSP, etc. So those are all things that are clustered around a CA. Some things that are around - -
There also have been people who've been rejected very, very publicly. And we discussed this on our podcast years ago, there was a Saudi company called Dark Matter that tried to become a public CA and basically, the public sentiment was that we do not feel from an integrity perspective, like this is a trustworthy organization. And at the end of the day, Dark Matter was not allowed to become a public CA. And so that's an element of this too, right. And that's part of the discussion as well. Especially in Mozilla, because Mozilla is so transparent and so public.
And then at the end, if you can get over the hoops for all four of these, these trust stores, then you'll be able to issue a certificate that will actually work inside of their devices, their browsers and operating systems. And then you go into the normal cadence of CA. You're expected to do the things CAs are expected to do. You get your annual audits, you report your bugs, you follow the rules of the root store programs. You do all of that stuff at that point.
I think for people who are curious about WebPKI, I don't think that the list of CAs is going to grow a lot in the future. I think it might tighten up a little more than it more than it’s probable of growing.
The first one makes perfect sense. There's just more and more of them. And there’s more than there’s ever been and there's going to be more tomorrow and more of the day after that. It's just a very clear trendline that's been true for decades and isn't going to change.
The variety of them is going up. There’s certs everywhere and like we talked about at the top of this podcast, you know, these sort of obscure certs that aren't just SSL are gaining prominence or that aren't sort of a traditional SSL. Like you think stick something on your server on the webpage, and it runs for years, right? Those have been gaining a lot of prominence as well.
The third component is that the complexity of the whole thing is getting harder, because you have all these different certs. They're serving different roles. They're sitting in different places. That makes the whole management task that much harder.
But then lastly, the stakes, right? Everything - not only is everything digital these days and if you go way, way, way back in time to our Tim's Digital Haircut episode, you'll get my thesis on this - but not only are the most offline things in the world, like hairdressers, and restaurants, 100% digitized, but in addition to that, it's all interconnected. So we are at the point now where if you pull down one tent pole, the whole tent falls, because everything is connected to anything else and one failure anywhere in the system brings down the whole system. And so there's this expectation that everything is digitized. There's this expectation of availability and always on. Like, can you remember, Jay, back in the 90s, where you'd have a favorite website, you'd go there to do whatever you're going to do and once in a while it wasn't running, and you go, eh, website is not running. Okay. And you go check back in an hour. And maybe it was running and if it wasn't, you’d go, okay, I guess I'll look tomorrow. And we thought that was normal. Right? Can you imagine what would happen if that were normal today?

