[TLS] Eleven out of every ten SSL certs aren't valid

[Peter Gutmann <[e-mail]>]

In case someone here still hasn't seen this, the subject is a reference to:

  SSL Certificates In Use Today Aren't All Valid
  http://www.esecurityplanet.com/features/article.php/3890171/SSL-Certificates-In-Use-Today-Arent-All-Valid.htm

which posits that only 3% of SSL certs in use today are valid.  The figures
seem a bit suspicious though, for example they claim 23 million SSL sites
while the same article quotes Netcraft as claiming there are 1.5 million SSL
certs in use (the Netcraft figures may be for CA-issued certs only, since they
quote Verisign as a percentage of that total).  Still, 3% seems pretty low,
could this be due to something like virtual hosting and the client not sending
the hostname, thereby getting the wrong cert?  Even with that though, I 
wouldn't have expected a 97% invalidity rate.

Peter.