Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Peter Gutmann <[e-mail]>]

Tim Dierks <[e-mail]> writes:

>What is being said is that 97% of DNS names that point at SSL servers do not
>validate with those DNS names. This is, on its face, is a statement about DNS
>configuration, not about SSL servers.

It really doesn't matter whose fault it is, what matters is how many users 
will see, and need to click away, cert warnings when they connect.  The user 
doesn't care less which obscure bit of geekery caused it, all they care about 
is that they're seeing yet another pointless dialog that they have to get rid 
of.

>To learn anything interesting about SSL servers at all, more work must be
>done.

What needs to be done is to define metrics for what's being analysed.  If you 
want a single figure then I'd use "Will a user connecting with IE6 / IE7 / 
Firefox / (and possibly Chrome) see a warning when they connect?" (to pick 
browsers with > 10% market share).  Why they see a warning is up to the geeks 
to figure out, the important metric in terms of security is what the users 
experience.

Peter.