Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Ivan Ristic <[e-mail]>]

On Tue, Jun 29, 2010 at 2:50 PM, Martin Rex <[e-mail]> wrote:
> Peter Gutmann wrote:
>>
>> In case someone here still hasn't seen this, the subject is a reference to:
>>
>>   SSL Certificates In Use Today Aren't All Valid
>>   http://www.esecurityplanet.com/features/article.php/3890171/SSL-Certificates-In-Use-Today-Arent-All-Valid.htm
>>
>> which posits that only 3% of SSL certs in use today are valid.  The figures
>> seem a bit suspicious though, for example they claim 23 million SSL sites
>> while the same article quotes Netcraft as claiming there are 1.5 million SSL
>> certs in use (the Netcraft figures may be for CA-issued certs only, since they
>> quote Verisign as a percentage of that total).  Still, 3% seems pretty low,
>> could this be due to something like virtual hosting and the client not sending
>> the hostname, thereby getting the wrong cert?  Even with that though, I
>> wouldn't have expected a 97% invalidity rate.
>
> From the quoted article:
>
> "Only about 3.17 percent of the domain names matched," Ristic said.
> (Ivan Ristic, director of engineering at Qualys)
> is probably about the scan engine to which an URL was posted to the
> TLS mailing list a short while ago:
>
> https://www.ssllabs.com/ssldb/index.html
>
> This is based on the seriously flawed assumption that a DNS entry that
> can be resolved into an IP-Address of a machine with a Web-Server on
> Port 80 will have the same Web-Server on Port 443 if port 443 is active.

If you're referring to my work, I didn't make any assumptions. I
merely reported the findings, which are that  about 3.17% of domain
names that respond with SSL on port 443 have a potentially valid
certificate.

If you're wondering, the results are without SNI. I will have another
run later with SNI enabled.


> Try "www.oracle.com", "www.googlemail.com", "www.gmx.de".
> You can get correct answers for "mail.google.com" and "www.gmx.net".
>
> What is really irritating is that a service like "www.hotmail.com"
> is not accessible via TLS _at_all_ and suggests you to enter
> username an password into a plain http form -- OUCH!
>
>
> -Martin
> _______________________________________________
> TLS mailing list
> [e-mail]
> https://www.ietf.org/mailman/listinfo/tls

-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]