MLCerts Docker Images (ICSE 2026)
Authors/Creators
-
1.
TU Wien
Description
Licensed under a Creative Commons Attribution 4.0 International License.
Auxiliary material, up to date documentation, and issue tracking available at: https://github.com/rub-softsec/MLCerts
The Datasets and Language Models are available at: https://zenodo.org/records/15971208
This archive contains a Docker image for the Differential Testing Framework, an image with patched Transcert implementation and an image for generating synthetic certificates using a pre-trained model.
MLCerts Differential Testing Framework
Run the image with the corresponding data directory mounted. The outputs of the testing framework will appear in /attached_dir/testing-results and /attached_dir/coverage directories.
docker load -i mlcerts_export.tar
docker run -it -v ./attached_dir_export:/attached_dir mlcerts_export bash
conda deactivate
cd /attached_dir
./mlcerts/run_testing.sh . ./cert_data_pem/v3-experiments/ ./mlcerts/ ./LIBS/ ./customCA/cacert.pem
Transcert
Run the image with the corresponding data directory mounted to find the patched Transcert source code (based on https://github.com/joky27/transcert_related).
docker load -i transcert_export.tar
docker run -it -v ./attached_dir_export:/attached_dir transcert_export bash
conda activate transcert
cd /attached_dir
The key modifications are to:
- Use fastcov instead of lcov.
- Use gmtime_adj* functions instead of set* due to a pyOpenSSL bug (https://github.com/pyca/pyopenssl/issues/311) that has not been fixed due to API deprecation.
Language Models
LM code requires installation of CUDA drivers specific to the GPUs available. For a simple demonstration, we release a container that relies on the main model used in the paper and uses CPU to generate certificates. The data directory to attach with the container needs to be downloaded: llm-code-mlcerts-export.zip from https://zenodo.org/records/15971208.
Run the image with the corresponding data directory mounted:
docker load -i mlcerts-llm-cpu-demo.tar
docker run -it -v ./MLcerts-EXPORT:/MLcerts-EXPORT mlcerts-llm-cpu-demo /bin/bash
Then, for generating synthetic certificates using final model used in paper (IPv4/RNN-Medium with Temperature = 1.5):
cd /MLcerts-EXPORT/Char-RNN-PyTorch
conda activate py39
python3 generate.py zmap-data-1024-3-0.0002lr-0.1dropout-epoch3-step300000 1024 3 1.5 zmap-data testZmap1M
The synthetic ASN outputs will appear in ./outputCerts directory. Due to the reliance on CPU, it may take ~10 minutes per output.
Finally, to convert ASN outputs to usable PEM formats:
cd /MLcerts-EXPORT/
conda activate myenv
python3 asn1_to_pem.py <asn_file_path> <output_dir_path> 2
python3 asn1_to_pem.py Char-RNN-PyTorch/outputCerts/zmap-data-1024-3-0.0002lr-0.1dropout-epoch3-step300000testZmap1M/fbbff4ee-67f0-423b-8647-5e11754ebdf3.asn . 2
and an output.XYZ.pem file is generated, using CA information from customCA/ directory.
BibTeX
Please cite our paper if you rely on our artifacts for your work.
@inproceedings{icse2026-hallucinating-certificates,
title = {{Hallucinating Certificates: Differential Testing of TLS Certificate Validation Using Generative Language Models}},
author = {Paracha, Talha and Posluns, Kyle and Borgolte, Kevin and Lindorfer, Martina and Choffnes, David},
booktitle = {Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE)},
date = {2026-04},
edition = {48},
editor = {Mezini, Mira and Zimmermann, Thomas},
location = {Rio de Janeiro, Brazil},
publisher = {Association for Computing Machinery (ACM)/Institute of Electrical and Electronics Engineers (IEEE)}
}