IETF Logo Mail Archive

Re: [TLS] Eleven out of every ten SSL certs aren't valid

Peter Gutmann <pgut001@cs.auckland.ac.nz> Wed, 30 June 2010 07:59 UTC

Return-Path: <pgut001@cs.auckland.ac.nz>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 0EA003A67EE for <tls@core3.amsl.com>; Wed, 30 Jun 2010 00:59:37 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.029
X-Spam-Level:
X-Spam-Status: No, score=-2.029 tagged_above=-999 required=5 tests=[AWL=0.570, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yWDKGqLxGKhu for <tls@core3.amsl.com>; Wed, 30 Jun 2010 00:59:36 -0700 (PDT)
Received: from mx2-int.auckland.ac.nz (mx2-int.auckland.ac.nz [130.216.12.41]) by core3.amsl.com (Postfix) with ESMTP id B1C2E3A67E5 for <tls@ietf.org>; Wed, 30 Jun 2010 00:59:35 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=simple/simple; d=auckland.ac.nz; i=pgut001@cs.auckland.ac.nz; q=dns/txt; s=uoa; t=1277884787; x=1309420787; h=from:to:subject:cc:in-reply-to:message-id:date; z=From:=20Peter=20Gutmann=20<pgut001@cs.auckland.ac.nz> |To:=20ivan.ristic@gmail.com,=20Nicolas.Williams@oracle.c om|Subject:=20Re:=20[TLS]=20Eleven=20out=20of=20every=20t en=20SSL=20certs=20aren't=20valid|Cc:=20pgut001@cs.auckla nd.ac.nz,=20tls@ietf.org|In-Reply-To:=20<20100629204614.G X11785@oracle.com>|Message-Id:=20<E1OTsCc-00010m-Vl@winte rmute02.cs.auckland.ac.nz>|Date:=20Wed,=2030=20Jun=202010 =2019:59:26=20+1200; bh=JVw0mZRyu6TzzwLBDoyNqIfVqGx904hZffnZOSAd9mE=; b=BWsVdksysUm/G8/vFhs0u08kSGNprYLwDUw882vhV4j2GC5wnX78fOIg 1dxSnEyVXA/OS7AD3YYSgyk9RUmdxzglDLEDspk5kM1pW3WIfJZp6epwO 32WD/tWOieKvVDrzyn6frCOV4iK7+4WZFHPKb4eq49pmkRJ8xKhOIp8Z7 M=;
X-IronPort-AV: E=Sophos;i="4.53,510,1272801600"; d="scan'208";a="13299205"
X-Ironport-HAT: UNIVERSITY - $RELAY-THROTTLE
X-Ironport-Source: 130.216.207.92 - Outgoing - Outgoing
Received: from wintermute02.cs.auckland.ac.nz ([130.216.207.92]) by mx2-int.auckland.ac.nz with ESMTP/TLS/AES256-SHA; 30 Jun 2010 19:59:27 +1200
Received: from pgut001 by wintermute02.cs.auckland.ac.nz with local (Exim 4.69) (envelope-from <pgut001@cs.auckland.ac.nz>) id 1OTsCc-00010m-Vl; Wed, 30 Jun 2010 19:59:27 +1200
From: Peter Gutmann <pgut001@cs.auckland.ac.nz>
To: ivan.ristic@gmail.com, Nicolas.Williams@oracle.com
In-Reply-To: <20100629204614.GX11785@oracle.com>
Message-Id: <E1OTsCc-00010m-Vl@wintermute02.cs.auckland.ac.nz>
Date: Wed, 30 Jun 2010 19:59:26 +1200
Cc: tls@ietf.org
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Jun 2010 07:59:37 -0000

Nicolas Williams <Nicolas.Williams@oracle.com> writes:
>On Tue, Jun 29, 2010 at 09:29:01PM +0100, Ivan Ristic wrote:
>> On Tue, Jun 29, 2010 at 8:34 PM, Nicolas Williams
>> > There is no such "problem with [my] view" because you cannot stop people
>> > from deploying servers with bad certs. <A0>It's a _fact of life_.
>>
>> The fact that we cannot stop bad certs is not relevant. Such sites are
>> still reducing the effectiveness of SSL, even for the "sites that
>> ought to be using HTTPS". And that was my point.
>
>Maybe, but if there's nothing you can do about this, what do you propose to
>do then?

The first step to recovery is to admit that you have a problem.

In this case we have a very serious problem (close to 100% false positives
rendering cert use _m_e_a_n_i_n_g_l_e_s_s_ - did I decorate that right?) and
if, as you say, there really isn't anything anyone can do about this then we
need to start looking at other solutions, because there's no way we can get
anywhere with the current one.

Peter.

v2.23.0 | Report a Bug | By Email