A Notary Extension for the Online Certificate Status Protocol

X.509 certificates are data structures that bind public key values to subjects. This binding aids in the proper identification and authentication of communicating parties. The current X.509 certificate status validation method is imperfect, and under certain circumstances it is possible to establish a ´secure´ connection using a rogue X.509 certificate. This paper reviews the current X.509 certificate status validation check and its limitations, and recommends extending the Online Certificate Status Protocol (OCSP) to include a notary query. We argue that this extension will significantly increase detection of rogue certificates presented during TLS/SSL connections.