Testing Certificate Authorities: An Empirical Study and Stateful Fuzzing Approach

Akshith Gunasekaran, Max Chase, Zane Ma, Rakesh B. Bobba and Manish Motwani.

Research artifact and stateful protocol testing framework for Certificate Authorities (CAs). This repository accompanies an empirical study of testing quality in ACME-based CA implementations and includes a specification-guided, black-box test generator that models RFC-defined workflows to systematically exercise certificate issuance, validation, revocation, and error handling. It evaluates real-world CAs (Boulder, Vault, Smallstep, XiPki), measures protocol and code coverage of developer-written tests, and exposes compliance and security flaws missed by existing test suites.

Repository Contents

This repository contains the code and resources used in the paper "Testing Certificate Authorities: An Empirical Study and Stateful Fuzzing Approach". The repository is organized as follows:

• ./cas/: Contains the setup and configuration files for running various Certificate Authorities (CAs) used in the study.
• ./ca-tester/: Contains the CA fuzzer implementation and related scripts.
• ./msr/: Contains the data and analysis scripts used for the empirical study.
• ./rfc-analysis/: Contains the RFC analysis scripts and data.

We tested the following CAs in our study:

1. Let's Encrypt Boulder
2. HashiCorp Vault
3. Smallstep CA
4. XiPki

Environment Setup

uv sync

CA Setup

Please refer to running all CAs in ./cas/RUNNING_ALL_CAS.md

CA Fuzzer

To run the CA fuzzer, use the Makefile targets in ./ca-tester/Makefile

License

This work is released under the Creative Commons Zero v1.0 Universal (CC0-1.0) license.