Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Martin Rex <[e-mail]>]

Ivan Ristic wrote:
> 
> Martin Rex wrote:
> >
> > From the quoted article:
> >
> > "Only about 3.17 percent of the domain names matched," Ristic said.
> > (Ivan Ristic, director of engineering at Qualys)
> > is probably about the scan engine to which an URL was posted to the
> > TLS mailing list a short while ago:
> >
> > https://www.ssllabs.com/ssldb/index.html
> >
> > This is based on the seriously flawed assumption that a DNS entry that
> > can be resolved into an IP-Address of a machine with a Web-Server on
> > Port 80 will have the same Web-Server on Port 443 if port 443 is active.
> 
> If you're referring to my work, I didn't make any assumptions. I
> merely reported the findings, which are that  about 3.17% of domain
> names that respond with SSL on port 443 have a potentially valid
> certificate.
> 
> If you're wondering, the results are without SNI. I will have another
> run later with SNI enabled.

That is going to make it only marginally better.

Since MSIE browsers on Windows XP (which is still at 50% of the market)
do not support SNI, the sites that require SNI to work will be rare.

Virtual hosting, on the other hand, is pretty common.  And buying
similar domain names and setting up HTTP-redirects is also pretty
common.

It is simply impossible to come up with meaningful numbers if
you starting point is DNS-records and accessible hosts.


-Martin