Re: [certid] SSL Labs Survey Data

=JeffH <Jeff.Hodges@KingsMountain.com> Fri, 05 November 2010 16:10 UTC

DomainKey-Signature: a=rsa-sha1; q=dns; c=nofws; s=default; d=kingsmountain.com; h=Received:Message-ID:Date:From:User-Agent:MIME-Version:To:Subject:Content-Type:Content-Transfer-Encoding:X-Identified-User; b=pbfyKHQGr5jAsQsK+3t6BuYuODqcH01D7l/Ki+ZNTWgsxF8L+sMCtgEcqtnSbiqpXgGH8W2oYYdQqBdwBfQy2Yw0vzp3t+jd2ctQaIqL1XKVHwQ1yGDtGKrEbFZKM2Tn;
Message-ID: <4CD42C99.3080505@KingsMountain.com>
Date: Fri, 05 Nov 2010 09:11:05 -0700
From: =JeffH <Jeff.Hodges@KingsMountain.com>
User-Agent: Thunderbird 2.0.0.24 (X11/20100411)
MIME-Version: 1.0
To: IETF cert-based identity <certid@ietf.org>
Content-Type: text/plain; charset=ISO-8859-1; format=flowed
Content-Transfer-Encoding: 7bit
Subject: Re: [certid] SSL Labs Survey Data
Precedence: list

Ivan replied..
 >
 > JeffH wrote:
 >>
 >> That explanation hints that most all the certs represented in the dataset
 >> would be "valid" certs. However, there's ~150k more entries in the dbase
 >> than the ~720K valid certs he observed. Though, there's ~150k apparently
 >> "self-signed" certs in the dbase, so perhaps that's what's filling out the
 >> dbase.
 >
 > The term "potentially valid" would be more accurate. The purpose of the
 > survey was to investigate how is an average SSL server configured and for
 > that we wanted to look at those servers that someone at least tried to
 > configure properly. There are so many invalid certificates out there, so
 > taking the configuration of all SSL servers would pollute the data.
 >
 > I defined "potentially valid" as residing on a domain name that matches the
 > certificate. Trust was not a factor, and that's why there are self-signed
 > certificates in the database. In addition, there's only one certificate per
 > domain name and IP address.
 >
 > The 720K certificates were obtained from the 119M data set of domain name
 > registrations. The additional 150K were obtained by looking at the Alexa's
 > top 1M sites, as well as by data mining web site names from the certificates
 > we obtained. The fact that there's about 150K self-signed certificates is a
 > coincidence.

That's helpful, thanks.

It'd be great if you could include that explanation (and/or post it on the web) 
along with the info from..

<http://blog.ivanristic.com/2010/07/ssl-server-survey-so-whats-with-the-22m-invalid-certificates-claim.html>

<http://blog.ivanristic.com/2010/07/ssl-server-survey-what-data-are-we-collecting.html>

..in a file in the data distro -- it'd help folks to better make use of it.

thanks again, having this data available is quite useful.

=JeffH

ps: also it'd be good to explain things such as the subjectCommonName dbase 
column comprising all the CN values in found in the Subject and then 
space-separated-concatenated.

Re: [certid] SSL Labs Survey Data =JeffH