IETF Logo Mail Archive

Re: [TLS] Eleven out of every ten SSL certs aren't valid

Tim Dierks <tim@dierks.org> Tue, 29 June 2010 21:10 UTC

Return-Path: <tdierks@gmail.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 674F33A697B for <tls@core3.amsl.com>; Tue, 29 Jun 2010 14:10:42 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.976
X-Spam-Level:
X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id SxX7-IgMcs7G for <tls@core3.amsl.com>; Tue, 29 Jun 2010 14:10:41 -0700 (PDT)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id 19B1C3A697A for <tls@ietf.org>; Tue, 29 Jun 2010 14:10:40 -0700 (PDT)
Received: by iwn40 with SMTP id 40so80217iwn.31 for <tls@ietf.org>; Tue, 29 Jun 2010 14:10:51 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:sender:received :in-reply-to:references:from:date:x-google-sender-auth:message-id :subject:to:cc:content-type; bh=jf4SkpbQDwO3+ylVsnJCTKxlXTKrzSTm5DwrBU9nITM=; b=vL1r11einuY3mnvryqrGA15o991K9Ng6T70FKqHH69gTovQzBMRtUf7q3SeIRAnmCK 6WO/N0vl8vIVUv+dIFxV1RjjoT9aJ3Np3r2tuOr4pQkVWlalxrFRzGR9zAYO9ydiVW6d /KAbU2dYL/AX9u8V4Qq8gjsBNAhzJOCayXhpk=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type; b=VCLJu0burMKBx2c2xsBlmlGwMWDPt/7eEZAs7yYU/fqThtpy5Y2sEgmMVRTlEWBE0H pooItujgIkoAdFhJziIWqUpV7HH6CYwO7HjoSuPR/OU5fnuzKOqSectXddK9aIJ6pK4j RvgESbEcXLQ+QNYp9iKdu4IRs5vuHagzp9WhI=
Received: by 10.231.150.15 with SMTP id w15mr7868132ibv.115.1277845851289; Tue, 29 Jun 2010 14:10:51 -0700 (PDT)
MIME-Version: 1.0
Sender: tdierks@gmail.com
Received: by 10.231.148.2 with HTTP; Tue, 29 Jun 2010 14:10:30 -0700 (PDT)
In-Reply-To: <20100629204614.GX11785@oracle.com>
References: <E1OTVaY-0004g3-OW@wintermute02.cs.auckland.ac.nz> <20100629163354.GR11785@oracle.com> <AANLkTim6sYWlPSRUwYHP4UfkUNkfiVQ7xbj28fF6fOmz@mail.gmail.com> <20100629193416.GU11785@oracle.com> <AANLkTilF3TZn4DcjTmoKrv3Zcp441oyvWp-E9aJmH5hF@mail.gmail.com> <20100629204614.GX11785@oracle.com>
From: Tim Dierks <tim@dierks.org>
Date: Tue, 29 Jun 2010 17:10:30 -0400
X-Google-Sender-Auth: EG2YOpue3HtSIOwtYud3UaaKHJ8
Message-ID: <AANLkTinByiAIx1Pg4khiXLPb9KMexp2UUoZB7ikLzd6f@mail.gmail.com>
To: Nicolas Williams <Nicolas.Williams@oracle.com>
Content-Type: multipart/alternative; boundary="005045013d240b3aaf048a31ac15"
Cc: tls@ietf.org
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jun 2010 21:10:42 -0000

On Tue, Jun 29, 2010 at 4:46 PM, Nicolas Williams <
Nicolas.Williams@oracle.com> wrote:

> The context was just how awful it is that 97% of servers don't have
> valid certs


That is not what is being said. What is being said is that 97% of DNS names
that point at SSL servers do not validate with those DNS names. This is, on
its face, is a statement about DNS configuration, not about SSL servers.
(Creating a thousand DNS names for the IP address of a single SSL server
will change this stat, although the owner and operator of the SSL server
need not be involved in any way.)

To learn anything interesting about SSL servers at all, more work must be
done.

 - Tim

v2.23.0 | Report a Bug | By Email