Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Marsh Ray <[e-mail]>]

On 06/29/2010 04:44 PM, Ivan Ristic wrote:
> On Tue, Jun 29, 2010 at 10:40 PM, Marsh Ray<[e-mail]>
> wrote:
>>
>> ...
>>
>> I liked the suggestion about looking for https: links on the net.
>> Scores could even be weighted by incoming links, a' la pagerank. If
>> a dns name really has zero links to it, it's questionable whether
>> or not its really relevant as a part of the web.
>
> Isn't that exactly what we'd be getting from looking at the most
> popular 1 million domain names?

Perhaps, but I would want a precise definition of "most popular" before 
agreeing to the "exactly". :-)

>> On the other hand, if your conclusion is [...]
>
> Well, that's the thing. I didn't make any conclusions, but there are
> several people on this list who assumed I did.

You've done something cool and ambitious and given some numbers to the 
press. It's fair to expect people to look at it very closely for stated 
and implied interpretations. (This is partly why it's rare to see 
researchers publish raw data with no analysis.)

Not to mention that the numbers by themselves raise some good questions 
for the SSL/TLS community. People want to discuss it with you.

 From TFA:
> "Only about 3.17 percent of the domain names matched," Ristic said.
> "So we have about 22 million SSL servers with certificates that are
> completely invalid because they do not match the domain name on which
> they reside."

This is where I think there's some room for legitimate discussion about 
the numbers as presented.

Is it correct to count a server reached from a misdirected DNS entry as 
"completely invalid" SSL?

According to the RFCs as I understand them, we can only say (an 
otherwise well-formed) cert is invalid in the context of a protocol, an 
requested identity, a set of trusted root certs, a time of validation, 
etc. We all know there's a good deal of variation in clients' trusted 
roots. Revocation data could be another interesting contextual variable.

- Marsh