Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Marsh Ray <[e-mail]>]

First of all, count me as one who thinks Ivan's work is really cool.

On 06/29/2010 01:29 PM, Ivan Ristic wrote:
>
> The problem with that view is that, while the users are experiencing
> all those sites with invalid certificates they are getting used to the
> idea that nothing bad comes from browser warnings.

But we don't know that, do we?

I mean, I can set up a web hosting server with an HTTPS-based "webmin" 
(or whatever admin page I might want to use). I could protect that admin 
login using a cert issued by my own private CA. I could then v-host 1000 
non-SSL web sites, still using only a single shared IP address.

Doesn't your methodology count this case as "1001 invalid certs" where, 
in reality, everything that is supposed to work is configured correctly?

- Marsh