IETF Logo Mail Archive

Re: [TLS] Eleven out of every ten SSL certs aren't valid

Ivan Ristic <ivan.ristic@gmail.com> Tue, 29 June 2010 21:16 UTC

Return-Path: <ivan.ristic@gmail.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 1CED43A697A for <tls@core3.amsl.com>; Tue, 29 Jun 2010 14:16:00 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.599
X-Spam-Level:
X-Spam-Status: No, score=-2.599 tagged_above=-999 required=5 tests=[BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id vxtyhDi-SfVL for <tls@core3.amsl.com>; Tue, 29 Jun 2010 14:15:49 -0700 (PDT)
Received: from fg-out-1718.google.com (fg-out-1718.google.com [72.14.220.159]) by core3.amsl.com (Postfix) with ESMTP id CDEBE3A67EC for <tls@ietf.org>; Tue, 29 Jun 2010 14:15:47 -0700 (PDT)
Received: by fg-out-1718.google.com with SMTP id 19so645043fgg.13 for <tls@ietf.org>; Tue, 29 Jun 2010 14:15:52 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=Mk8TMwXWYhlouzabrFaImUrylNcDavSYXV3kB8rhM+o=; b=LtTNrVTli40Fs90bBMZug4U0Aq+IWNO1ZkAUxqc+sjA2Pf01B/78wmlZQfNAdrkl11 DZwOxkTMSGbeljH7msFKmlkjBDk7KmbA8HGXji7GkrDH0cjykkUsWEl7MTKYvs5lBdO5 BxbaFy7etZ4f5zQFUrFHXlrD2RZ2JgjGIjOHc=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=BRbKcNu5i3m+cHz+EDoJN8iGJWnT8fRgPWL9kE0T+w/Dy6vt/iiRq+ialC3uKfO8ln mPMnfKpLIfEsgGr+dlVHpzn+DIlFt6S4qOinWz91l83Q3PtEv1MtTz1gUX/Tjsk+qgq9 37m9/wE/fO6tAmABRPuhJUJfs1xxezQ7G34yk=
MIME-Version: 1.0
Received: by 10.239.130.196 with SMTP id 4mr464517hbk.185.1277846150769; Tue, 29 Jun 2010 14:15:50 -0700 (PDT)
Received: by 10.239.164.79 with HTTP; Tue, 29 Jun 2010 14:15:50 -0700 (PDT)
In-Reply-To: <AANLkTinByiAIx1Pg4khiXLPb9KMexp2UUoZB7ikLzd6f@mail.gmail.com>
References: <E1OTVaY-0004g3-OW@wintermute02.cs.auckland.ac.nz> <20100629163354.GR11785@oracle.com> <AANLkTim6sYWlPSRUwYHP4UfkUNkfiVQ7xbj28fF6fOmz@mail.gmail.com> <20100629193416.GU11785@oracle.com> <AANLkTilF3TZn4DcjTmoKrv3Zcp441oyvWp-E9aJmH5hF@mail.gmail.com> <20100629204614.GX11785@oracle.com> <AANLkTinByiAIx1Pg4khiXLPb9KMexp2UUoZB7ikLzd6f@mail.gmail.com>
Date: Tue, 29 Jun 2010 22:15:50 +0100
Message-ID: <AANLkTik5HjADIdqIy4vzQrkQmP4nEwVa0xJUQ-gmkJvT@mail.gmail.com>
From: Ivan Ristic <ivan.ristic@gmail.com>
To: Tim Dierks <tim@dierks.org>
Content-Type: multipart/mixed; boundary="001636499069e4ee0f048a31bddc"
X-Mailman-Approved-At: Tue, 29 Jun 2010 14:35:39 -0700
Cc: tls@ietf.org
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jun 2010 21:16:02 -0000

On Tue, Jun 29, 2010 at 10:10 PM, Tim Dierks <tim@dierks.org> wrote:
> On Tue, Jun 29, 2010 at 4:46 PM, Nicolas Williams
> <Nicolas.Williams@oracle.com> wrote:
>>
>> The context was just how awful it is that 97% of servers don't have
>> valid certs
>
> That is not what is being said. What is being said is that 97% of DNS names
> that point at SSL servers do not validate with those DNS names. This is, on
> its face, is a statement about DNS configuration, not about SSL servers.
> (Creating a thousand DNS names for the IP address of a single SSL server
> will change this stat, although the owner and operator of the SSL server
> need not be involved in any way.)
>
> To learn anything interesting about SSL servers at all, more work must be
> done.

Yes, of course. I am attaching some of the metrics I will be
collecting from the 720K domains that have potentially valid
certificates. That's the meat of my survey.

It's too late to change the metrics now (I've started with the
collection), but the plan is to continue with the survey indefinitely.

-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]

v2.23.0 | Report a Bug | By Email