Managed TLS Under Migration: Authentication Authority Across CDN and Hosting Transitions

• URL: http://arxiv.org/abs/2512.07033v1
• Date: Sun, 07 Dec 2025 22:52:52 GMT
• Title: Managed TLS Under Migration: Authentication Authority Across CDN and Hosting Transitions
• Abstract summary: This study investigates how managed TLS platforms behave when a domain is moved away from the platform that originally issued and stored its certificate.<n> measurements show that platforms continue to serve the same certificate until it expires, even after DNS resolvers direct traffic toward new infrastructure.<n>Findings indicate that authentication authority remains with the previous platform for the entire lifetime of certificates issued during the delegation period.
• Score: 0.0
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Managed TLS has become a common approach for deploying HTTPS, with platforms generating and storing private keys and automating certificate issuance on behalf of domain operators. This model simplifies operational management but shifts control of authentication material from the domain owner to the platform. The implications of this shift during provider transitions remain insufficiently examined. This study investigates how managed TLS platforms behave when a domain is moved away from the platform that originally issued and stored its certificate. A controlled measurement environment was used to monitor multiple platforms after migration. Each platform was observed for the full remaining lifetime of the certificate that had been active during delegation. The measurements show that platforms continue to serve the same certificate until it expires, even after DNS resolvers direct traffic toward new infrastructure. No platform revoked, replaced, or retired the certificate, and no new certificate was issued after delegation ended. Direct connections to the previous platform continued to complete TLS handshakes with the stale certificate, which confirms that authentication capability persisted independently of DNS state. These findings indicate that authentication authority remains with the previous platform for the entire lifetime of certificates issued during the delegation period. The gap between DNS control and control of authentication material introduces a window in which multiple environments can authenticate the same domain. As managed TLS adoption grows, clearer mechanisms for key retirement and certificate invalidation are needed to ensure that the authentication authority follows operational authority during transitions.

Related papers

• Session Attestation for Unmodified TLS Services in Confidential Virtual Machines [0.9825966924601678]
  We present SessionLatch, which provides session attestation while preserving all three.<n>A temporary latch holds client encrypted records while evidence exchange overlaps the application TLS handshake, then removes itself after verification.<n>SessionLatch reduces short-upload mean latency by 63.1%/23.0% relative to TNG in interleaved Linux/Windows experiments.
  arXiv  Detail & Related papers  (2026-09-09T03:36:24Z)
• ACLE-MCP: Attested Capability Leases for Execution-Time Trust in Remote LLM Tool Use [29.860376266824872]
  OAuth authorization alone does not ensure that a later tool call is executed by the provider-side workload that the relying party intended to trust.<n>We present ACLE-MCP, an invocation-scoped architecture that couples delegated authorization, workload appraisal, and resource-side execution admission.
  arXiv  Detail & Related papers  (2026-09-02T14:58:17Z)
• FIDEM: A Standard-Compliant Framework for Secure Binding of MUD Profiles to IoT Devices [90.91375734523943]
  FIDEM is a standard-compliant framework for securing DHCP-based MUD URL issuance.<n>It provides cryptographic binding between IoT devices and their MUD profiles by leveraging Zero-Knowledge-Proof authentication.
  arXiv  Detail & Related papers  (2026-05-28T09:16:50Z)
• Securing the Web with HSTS-Enforced [42.091774598477706]
  TLS stripping attacks expose sensitive web traffic by forcing secure HTTPS connections to fall back to unencrypted HTTP.<n> protection against these attacks relies on website operators explicitly opting into security by deploying mechanisms such as HTTP Strict Transport Security (HSTS) headers.<n>We introduce HSTS-Enforced, a mechanism that eliminates the remaining attack surface for TLS stripping while still allowing operators to securely specify that their websites need to be accessed over HTTP.
  arXiv  Detail & Related papers  (2026-05-06T08:33:12Z)
• Give Them an Inch and They Will Take a Mile:Understanding and Measuring Caller Identity Confusion in MCP-Based AI Systems [31.49827652669055]
  We show that treating MCP servers as trusted entities without authenticating the caller identity is fundamentally insecure.<n>Most MCP servers rely on persistent authorization states, allowing tool invocations after an initial authorization without re-authentication.<n>Many MCP servers fail to enforce authentication at the per-tool level, enabling unauthorized access to sensitive operations.
  arXiv  Detail & Related papers  (2026-03-08T05:24:16Z)
• Post-Quantum Identity-Based TLS for 5G Service-Based Architecture and Cloud-Native Infrastructure [0.5735035463793009]
  We present a certificate-free authentication framework for private distributed systems based on post-quantum Identity-Based Encryption (IBE)<n>Our design replaces certificate and signature based authentication with identity-derived keys and identity-based key encapsulation, enabling mutually authenticated TLS connections without certificate transmission or validation.<n>We apply this framework to cloud-native application deployments and latency-sensitive 5G Core networks.
  arXiv  Detail & Related papers  (2026-02-04T05:55:41Z)
• VET Your Agent: Towards Host-Independent Autonomy via Verifiable Execution Traces [5.948440195568225]
  VET (Verifiable Execution Traces) is a formal framework that achieves host-independent authentication of agent outputs.<n>Central to VET is the Agent Identity Document (AID), which specifies an agent's configuration.<n>We implement VET for an API-based LLM agent and evaluate our instantiation on realistic workloads.
  arXiv  Detail & Related papers  (2025-12-17T19:05:37Z)
• Establishing Workload Identity for Zero Trust CI/CD: From Secrets to SPIFFE-Based Authentication [0.0]
  CI/CD systems have become privileged automation agents in modern infrastructure, but their identity is still based on secrets or temporary credentials passed between systems.<n>This paper describes the shift from static credentials to OpenID Connect (OIDC) federation, and introduces SPIFFE as a platform-neutral identity model for non-human actors.
  arXiv  Detail & Related papers  (2025-04-20T23:06:03Z)
• Shh, don't say that! Domain Certification in LLMs [124.61851324874627]
  Large language models (LLMs) are often deployed to perform constrained tasks, with narrow domains.<n>We introduce domain certification; a guarantee that accurately characterizes the out-of-domain behavior of language models.<n>We then propose a simple yet effective approach, which we call VALID that provides adversarial bounds as a certificate.
  arXiv  Detail & Related papers  (2025-02-26T17:13:19Z)
• DID Link: Authentication in TLS with Decentralized Identifiers and Verifiable Credentials [0.0]
  This article presents DID Link, a novel authentication scheme for TLS 1.3.<n>It empowers entities to authenticate in a TLS-compliant way with self-issued X.509 certificates that are equipped with ledger-anchored DIDs.<n>A prototypical implementation shows comparable TLS handshake durations of DID Link if verification material is cached and reasonable prolongations if it is obtained from a ledger.
  arXiv  Detail & Related papers  (2024-05-13T08:03:32Z)
• A Novel Protocol Using Captive Portals for FIDO2 Network Authentication [45.84205238554709]
  We introduce FIDO2CAP: FIDO2 Captive-portal Authentication Protocol. We develop a prototype of FIDO2CAP authentication in a mock scenario. This work makes the first systematic approach for adapting network authentication to the new authentication paradigm relying on FIDO2 authentication.
  arXiv  Detail & Related papers  (2024-02-20T09:55:20Z)
• Tamper-Evident Pairing [55.2480439325792]
  Tamper-Evident Pairing (TEP) is an improvement of the Push-Button configuration (PBC) standard. TEP relies on the Tamper-Evident Announcement (TEA), which guarantees that an adversary can neither tamper a transmitted message without being detected, nor hide the fact that the message has been sent. This paper provides a comprehensive overview of the TEP protocol, including all information needed to understand how it works.
  arXiv  Detail & Related papers  (2023-11-24T18:54:00Z)
• Fossil 2.0: Formal Certificate Synthesis for the Verification and Control of Dynamical Models [54.959571890098786]
  This paper presents Fossil 2.0, a new major release of a software tool for the synthesis of certificates. Fossil 2.0 is much improved from its original release, including new interfaces and a significantly expanded certificate portfolio.
  arXiv  Detail & Related papers  (2023-11-16T11:18:21Z)
• SyzTrust: State-aware Fuzzing on Trusted OS Designed for IoT Devices [67.65883495888258]
  We present SyzTrust, the first state-aware fuzzing framework for vetting the security of resource-limited Trusted OSes. SyzTrust adopts a hardware-assisted framework to enable fuzzing Trusted OSes directly on IoT devices. We evaluate SyzTrust on Trusted OSes from three major vendors: Samsung, Tsinglink Cloud, and Ali Cloud.
  arXiv  Detail & Related papers  (2023-09-26T08:11:38Z)
• COPA: Certifying Robust Policies for Offline Reinforcement Learning against Poisoning Attacks [49.15885037760725]
  We focus on certifying the robustness of offline reinforcement learning (RL) in the presence of poisoning attacks. We propose the first certification framework, COPA, to certify the number of poisoning trajectories that can be tolerated. We prove that some of the proposed certification methods are theoretically tight and some are NP-Complete problems.
  arXiv  Detail & Related papers  (2022-03-16T05:02:47Z)
• Postcertificates for Revocation Transparency [3.4269133917069263]
  We propose a new revocation transparency protocol that introduces postcertificates and utilizes the existing Certificate Transparency (CT) logs. The protocol is practical, has a low deployment cost, provides an immutable history of revocations, enables delegation, and helps to detect revocation-related misbehavior. We evaluate the protocol, measure log and monitor performance, and conclude that it is possible to provide revocation transparency using existing CT logs.
  arXiv  Detail & Related papers  (2022-03-03T18:43:09Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.