Transport Layer Security (TLS) is a rather complex protocol suite for securing data transfer on the Internet. A lot of its security stems from correctly validating certificates of the communicating parties. However, different TLS libraries have very different certificate validation errors and transferring knowledge from one to another is difficult. In the project "Usable certificate validation" (x509errors.org), we aim to improve the situation.

This thesis aims to compare X.509 certificate validation errors across multiple common TLS-enabled libraries. Specifically, the student will:

• Create well-documented implementation of establishing TLS connections with properly checking the certificate validity for at least three common TLS-enabled libraries. These implementations should be published, aiming to be used as referential by other programmers.
• Generate malformed certificate chains that demonstrate as many certificate validation errors as possible (at least fifty). The generation should be performed in a reliable and reproducible manner.
• Based on the code and certificates from the previous two points, create a correspondence mapping among X.509 errors across TLS libraries. Briefly evaluate the obtained data.

The thesis is a part of usable security research activities in CRoCS. The specific thesis assignment is up to discussion with the student taking into account his/her experience and interests. The prerequisites include basic knowledge of security and willingness to flexibly learn new knowledge and skills. Previous experience with quantitative data analysis is an advantage but can be learned in the process.