Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Tim Dierks <[e-mail]>]

On Tue, Jun 29, 2010 at 11:19 AM, Ivan Ristic <[e-mail]> wrote:

> On Tue, Jun 29, 2010 at 3:36 PM, Tim Dierks <[e-mail]> wrote:
> > On Tue, Jun 29, 2010 at 10:15 AM, Ivan Ristic <[e-mail]>
> wrote:
> >>
> >> If you're referring to my work, I didn't make any assumptions. I
> >> merely reported the findings, which are that  about 3.17% of domain
> >> names that respond with SSL on port 443 have a potentially valid
> >> certificate.
> >
> > In my opinion, this is a pretty meaningless statistic. There's no
> warranty
> > that just because a domain name maps to an IP address and that IP address
> > has an SSL server that the SSL server will respond with a certificate
> that
> > matches the domain name in question. If I go and register a thousand
> domain
> > names and give each one a CNAME that points to www.modsecurity.org, and
> you
> > go and find it serves SSL on 443, but doesn't present the certificates
> for
> > my domains, so this percentage goes down, what does that mean? Nothing at
> > all.
>
> Certainly, the measurement is imperfect. I find it useful, even if you
> don't.
>

What is it useful for? What behavior or process is more or less secure in
some correlation with this value? If it went from 3% to some other number
(either up or down), what would that imply?

Best wishes,
 - Tim