Re: [TLS] Eleven out of every ten SSL certs aren't valid

[[e-mail]]

On Tue, Jun 29, 2010 at 1:22 PM, Ivan Ristic <[e-mail]> wrote:
>> I mean, I can set up a web hosting server with an HTTPS-based "webmin" (or
>> whatever admin page I might want to use). I could protect that admin login
>> using a cert issued by my own private CA. I could then v-host 1000 non-SSL
>> web sites, still using only a single shared IP address.
>>
>> Doesn't your methodology count this case as "1001 invalid certs" where, in
>> reality, everything that is supposed to work is configured correctly?
>
> I disagree that your described setup is working correctly. In my view,
> if you delegate a domain name to a server, you should either respond
> properly (with the same site) on both 80 and 443, or shut down port
> 443 if you don't need/want SSL.

If he wants to avoid a childporn site being set up on his server, you had better bet he's only going to submit his credentials to create a new site across an encrypted connection.

The problem that you're not seeing is this: computers do not see themselves as names.  Physical interfaces don't have public names, other than their IP addresses.

DNS is not associated with computer interfaces, it's a means of taking a *name* and changing it to an *IP address*, very much like a distributed directory.  The computer has no sense of what names are pointed to it, and DNS doesn't care if there are any services presented by the computer it's pointing to -- or even *what* those services might be.  We have _mscds.domain.name.here and TXT records with semantics different from their original meaning pointing to services, when dealing with multicast DNS -- but even then, that's all management, that's not inherent to the protocol.

If I delegate 2000 name-based virtual host configurations to a server, and I only want to administer it via TLS (possibly/probably with client-certificate authentication, to prevent *anyone* else from screwing with it), I still have to leave port 443 open for that one purpose -- and with places like myhosting.com, the administration that I can perform occurs via the same public IP.

So, I accept your "should" as the RFC states: Implementors are "strongly encouraged" to do this, but they are not "mandated" to do this.  There do exist many configurations outside of your concept of "a separate physical administrative interface".  There is no way to say "only open port 443 if it's accessed by this name".

Your numbers are worse than meaningless, they are simply noise.

-Kyle H