Root of the Problem : Exploring CA Trust Structures in the World’s Most Visited Domains using Censys and CCADB

The Web Public Key Infrastructure relies on a hierarchical trust model rooted in Certificate Authorities (CAs), with intermediate certificates bridging leaf certificates and trusted roots.Prior work has focused either on leaf level behavior or on isolated security incidents; large scale empirical analyses of intermediates remain scarce.This thesis presents a systematic study of intermediate and root certificates collected from the Tranco Top 1 Million, combining active scans from Censys with registry data from the Common CA Database (CCADB).We observe that 79% of leaf certificates contain valid AKIDs, mapping to just 2635 unique intermediates, and that 689 intermediates registered in CCADB issue 686,316 of 690,237 leaf certificates (99.4%).Conversely, 947 off-registry intermediates appear in only 0,6% of leaf issuance.We also documented wide variation in certificate validity periods, geographic concentration, and occasional mismatches between observed chains and public trust stores.These findings reveal extreme centralization among high volume intermediates, complete CCADB compliance for the top 20 versus a small, under-registered long tail, and underscore the need for continous monitoring and better alignment between issuance practices and trust-store policies.We would like to thank the Censys team for providing us with their API.We similarly thank CCADB for providing the database that is used in this thesis.We would like to thank Carl Magnus Bruhner, PhD student at Linkpings University, for his input and help regarding the dataset, code for sorting the information in the dataset and for reviewing our thesis.Also, thanks to our fellow students Sofia, Eleanor, Lukas