Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Ivan Ristic <[e-mail]>]

Nico, forgive me for not answering your questions, but I don't have
enough time to give them justice.

In brief, I am not demanding nor proposing anything. I am just
measuring. If you can think of a better way to measure things, I will
be all ears.

On Tue, Jun 29, 2010 at 9:35 PM, Nicolas Williams
<[e-mail]> wrote:
> On Tue, Jun 29, 2010 at 09:22:50PM +0100, Ivan Ristic wrote:
>> On Tue, Jun 29, 2010 at 8:13 PM, Marsh Ray <[e-mail]> wrote:
>> > I mean, I can set up a web hosting server with an HTTPS-based "webmin" (or
>> > whatever admin page I might want to use). I could protect that admin login
>> > using a cert issued by my own private CA. I could then v-host 1000 non-SSL
>> > web sites, still using only a single shared IP address.
>> >
>> > Doesn't your methodology count this case as "1001 invalid certs" where, in
>> > reality, everything that is supposed to work is configured correctly?
>>
>> I disagree that your described setup is working correctly. In my view,
>> if you delegate a domain name to a server, you should either respond
>> properly (with the same site) on both 80 and 443, or shut down port
>> 443 if you don't need/want SSL.
>
> Do you consider an otherwise valid (unexpired, ...) self-signed cert to
> be valid?  What if it's not pre-shared to you?
>
> Do you consider an otherwise valid cert to be invalid if you have no
> validation path for it to a CA you trust?  What if someone else can find
> a validation path for it to a CA _they_ trust?
>
> Surely it would be fine to have servers that by default generate
> self-signed certs and use those for HTTPS.  Or do you disagree?  Do you
> reject the use of pre-sharing of certs?  Do you demand that we all use
> actual PKIs?
>
> Nico
> --
>



-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]