IETF Logo Mail Archive

Re: [TLS] Eleven out of every ten SSL certs aren't valid

Ivan Ristic <ivan.ristic@gmail.com> Tue, 29 June 2010 15:39 UTC

Return-Path: <ivan.ristic@gmail.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id A14973A68DE for <tls@core3.amsl.com>; Tue, 29 Jun 2010 08:39:02 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.135
X-Spam-Level:
X-Spam-Status: No, score=-1.135 tagged_above=-999 required=5 tests=[AWL=-0.395, BAYES_20=-0.74]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id J2qZlIcL5yd3 for <tls@core3.amsl.com>; Tue, 29 Jun 2010 08:38:59 -0700 (PDT)
Received: from mail-fx0-f44.google.com (mail-fx0-f44.google.com [209.85.161.44]) by core3.amsl.com (Postfix) with ESMTP id 378903A6B98 for <tls@ietf.org>; Tue, 29 Jun 2010 08:38:57 -0700 (PDT)
Received: by fxm1 with SMTP id 1so1490820fxm.31 for <tls@ietf.org>; Tue, 29 Jun 2010 08:39:05 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:mime-version:received:received:in-reply-to :references:date:message-id:subject:from:to:cc:content-type; bh=rSiYDShiTSfMCfJIGlIzcLIvwcGvqtmRzsDYdoRjt4k=; b=JHv+dHUzI7pTqCWLSttEPYIdXInevfcw4Eb2omzNT3HxORQiQlxmjbPK+sGOmOVHFG 8epY65/qnmhRKNF6JdKVOG1XH1LGs2HrJphTThKU4jWYJcFiF+UEecIAK8Nn/1DfICsb Z7qHLpRJ8UqNq8Z/GJIU5WHqaMRv82dJ9KBdg=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; b=LVLjKqYNRZlUSPyRJVnOGTisfVa55kMCI5Je80N+0tT+dRY7tXUxsI3iPguf1PF455 4Su9S6alsfcUnitxNbdTI/bcVeY9ErCxVE+U94gmyE19y3/5u3TmCf0aSv7zjFGsmmy4 nnnL+rLi6p7UvmqZVpprTwFEBGnU4YMNM7yW0=
MIME-Version: 1.0
Received: by 10.239.130.196 with SMTP id 4mr409696hbk.185.1277825944163; Tue, 29 Jun 2010 08:39:04 -0700 (PDT)
Received: by 10.239.164.79 with HTTP; Tue, 29 Jun 2010 08:39:04 -0700 (PDT)
In-Reply-To: <7C6BDB4BD9974646856544650C016B82139E7C@XCH117CNC.rim.net>
References: <E1OTVaY-0004g3-OW@wintermute02.cs.auckland.ac.nz> <201006291350.o5TDoMoO018788@fs4113.wdf.sap.corp> <AANLkTinWDU7RKXRU1drErtWZSdOyGwSymOBdwXSnYMEB@mail.gmail.com> <7C6BDB4BD9974646856544650C016B82139E7C@XCH117CNC.rim.net>
Date: Tue, 29 Jun 2010 16:39:04 +0100
Message-ID: <AANLkTilFGxsxGs9DD737SvlAL-2x1SLp0iaP2wq0u80p@mail.gmail.com>
From: Ivan Ristic <ivan.ristic@gmail.com>
To: Rob P Williams <rwilliams@certicom.com>
Content-Type: text/plain; charset="ISO-8859-1"
Cc: "tls@ietf.org" <tls@ietf.org>
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jun 2010 15:39:04 -0000

On Tue, Jun 29, 2010 at 4:03 PM, Rob P Williams <rwilliams@certicom.com> wrote:
>
> ...
>
> What steps are being taken to verify that 'valid' ssl is even intended?

I have collected about 720K certificates that match the domain names
from which they were served. I think it's fair to say those are the
cases where SSL was intended.

Obtaining those certificates was the goal of the first phase of my
survey. All these other numbers are just a byproduct of that.


> These sound like numbers intended to scare people. If you are going to publish without the first paragraph mentioning that "100% of modern browsers will alert a user to configuration issues that are detected herein" - then... what's your point?

The numbers are real, and if they scare some people so be it. My point
is to look at how SSL is used in real world and report it. I am in the
middle of my research and I don't know yet what I will find, but for
me the value is in knowing, irrespective of the results.

-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]

v2.23.0 | Report a Bug | By Email