Usage of HTTPS by Municipal Websites in Portugal

Abstract

This paper presents a study on the adoption of HTTPS in the official websites of all (308) Portuguese municipalities. Automated and, whenever needed, manual analysis were used to investigate its entry pages. Specifically, the pages were checked for the existence of an HTTPS site; the correctness of the certificates and their certification chain; coherence between contents of the HTTP and HTTPS sites; redirection between HTTP and HTTPS, HTTP resources fetched through HTTPS, and exploitation of HSTS. A final classification of municipalities was produced and possible determinants for the results were investigated. The general conclusion is that there is still much to be done in order to assure that citizens can communicate securely with all the Portuguese municipalities. Indeed, only 3.6% of the municipalities were considered good in this regard, while 46.1% do not guarantee the minimum conditions. These results seem to be associated with the dimension of the municipalities, although it was also identified the need for additional explanatory factors