PoliCT: Flexible Policy in Certificate Transparency Enabling Lightweight Self-monitor

Certificate Transparency (CT) is proposed to detect maliciously or mistakenly issued certificates by recording all certificates in publicly-visible logs. CT assumes that any individual can undertake the role of a CT monitor which fetches all the certificates in the logs and discovers suspicious ones from them. However, studies in recent years shows that ordinary individuals have to pay an unbearable price to operate a monitor by themselves, which makes the originally distributed trust be concentrated on several third-party monitors. Unfortunately, some researches indicate that problems of timeliness, security, and reliability exist in third-party monitors. In this paper, we propose the PoliCT, a flexible and customizable certificate transparency management solution where domain owners can designate how their certificates should be submitted and validated. It enables domain owners (a) to release their CT policies to monitor a few logs purposefully, thereby greatly reducing monitoring costs; (b) to demand more SCTs to increase the transparency of their certificates. After that, we discuss the design of a reliable lightweight self-monitor in detail. Expectably, the actual data collection and the theoretical analysis of the prototype system show that PoliCT enables a common individual to maintain its CT policies with negligible overhead, and significantly improves the performance of monitoring service.