Systems and methods for validating self-signed certificates

摘要

A computer-implemented method for validating self-signed certificates may include (1) identifying a self-signed certificate associated with an application, (2) identifying a publisher allegedly responsible for publishing the application, (3) identifying a website associated with the publisher allegedly responsible for publishing the application, (4) determining that the website references the application, (5) determining that a website certificate associated with the website has been signed by a certificate authority, and (6) validating the self-signed certificate in response to determining both that the website references the application and that the website certificate associated with the website has been signed by the certificate authority. Various other methods, systems, and computer-readable media are also disclosed.

主权项

1. A computer-implemented method for validating self-signed certificates, at least a portion of the method being performed by a computing device comprising at least one processor, the method comprising:
identifying a self-signed certificate associated with an application, wherein the self-signed certificate:
certifies the identity of an entity;has been signed by the same entity whose identity is being certified, rather than a third-party certificate authority; identifying a publisher allegedly responsible for publishing the application; identifying a website associated with the publisher allegedly responsible for publishing the application; determining that the website references the application by:
crawling the website for a reference to the application while ignoring content within the website created by external entities;while crawling the website, determining that the website contains a link to an application distribution platform that hosts the application; determining that a website certificate associated with the website has been signed by a certificate authority; validating the self-signed certificate in response to determining both that the website references the application and that the website certificate associated with the website has been signed by the certificate authority.