The landscape of security certifications such as Common
Criteria (CC) and FIPS 140 plays a pivotal role in ensuring
trust and compliance within the global cybersecurity ecosystem.
However, despite their importance, systematic cross-analysis of
certification data remains limited. This thesis leverages the
sec-certs project—a unified, open-source platform aggregating
and annotating CC and FIPS 140 certification data—to gain
deeper, data-driven insights into certification trends and
practices.

    The research explores two primary use cases. The first
investigates the prevalence of OpenSSL and its alternatives
across certified products, examining temporal trends, vendor
dependencies, and standard-specific adoption patterns. The
second analyzes Linux-based FIPS-validated products, with a
particular focus on comparing the certification portfolios of
Red Hat and other major vendors in terms of time, product
types, and architectures.