Licensed under a Creative Commons Attribution 4.0 International License. Auxiliary material, up to date documentation, and issue tracking available at: https://github.com/rub-softsec/MLCerts The Datasets and Language Models are available at: https://zenodo.org/records/15971208 This archive contains a Docker image for the Differential Testing Framework, an image with patched Transcert implementation and an image for generating synthetic certificates using a pre-trained model. MLCerts Differential Testing Framework Run the image with the corresponding data directory mounted. The outputs of the testing framework will appear in /attached_dir/testing-results and /attached_dir/coverage directories. docker load -i mlcerts_export.tar docker run -it -v ./attached_dir_export:/attached_dir mlcerts_export bash conda deactivate cd /attached_dir ./mlcerts/run_testing.sh . ./cert_data_pem/v3-experiments/ ./mlcerts/ ./LIBS/ ./customCA/cacert.pem Transcert Run the image with the corresponding data directory mounted to find the patched Transcert source code (based on https://github.com/joky27/transcert_related). docker load -i transcert_export.tar docker run -it -v ./attached_dir_export:/attached_dir transcert_export bash conda activate transcert cd /attached_dir The key modifications are to: Use fastcov instead of lcov. Use gmtime_adj* functions instead of set* due to a pyOpenSSL bug (https://github.com/pyca/pyopenssl/issues/311) that has not been fixed due to API deprecation. Language Models LM code requires installation of CUDA drivers specific to the GPUs available. For a simple demonstration, we release a container that relies on the main model used in the paper and uses CPU to generate certificates. The data directory to attach with the container needs to be downloaded: llm-code-mlcerts-export.zip from https://zenodo.org/records/15971208. Run the image with the corresponding data directory mounted: docker load -i mlcerts-llm-cpu-demo.tar docker run -it -v ./MLcerts-EXPORT:/MLcerts-EXPORT mlcerts-llm-cpu-demo /bin/bash Then, for generating synthetic certificates using final model used in paper (IPv4/RNN-Medium with Temperature = 1.5): cd /MLcerts-EXPORT/Char-RNN-PyTorch conda activate py39 python3 generate.py zmap-data-1024-3-0.0002lr-0.1dropout-epoch3-step300000 1024 3 1.5 zmap-data testZmap1M The synthetic ASN outputs will appear in ./outputCerts directory. Due to the reliance on CPU, it may take ~10 minutes per output. Finally, to convert ASN outputs to usable PEM formats: cd /MLcerts-EXPORT/ conda activate myenv python3 asn1_to_pem.py 2 python3 asn1_to_pem.py Char-RNN-PyTorch/outputCerts/zmap-data-1024-3-0.0002lr-0.1dropout-epoch3-step300000testZmap1M/fbbff4ee-67f0-423b-8647-5e11754ebdf3.asn . 2 and an output.XYZ.pem file is generated, using CA information from customCA/ directory. BibTeX Please cite our paper if you rely on our artifacts for your work. @inproceedings{icse2026-hallucinating-certificates, title = {{Hallucinating Certificates: Differential Testing of TLS Certificate Validation Using Generative Language Models}}, author = {Paracha, Talha and Posluns, Kyle and Borgolte, Kevin and Lindorfer, Martina and Choffnes, David}, booktitle = {Proceedings of the 48th IEEE/ACM International Conference on Software Engineering (ICSE)}, date = {2026-04}, edition = {48}, editor = {Mezini, Mira and Zimmermann, Thomas}, location = {Rio de Janeiro, Brazil}, publisher = {Association for Computing Machinery (ACM)/Institute of Electrical and Electronics Engineers (IEEE)} }