Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Martin Rex <[e-mail]>]

Peter Gutmann wrote:
> 
> In case someone here still hasn't seen this, the subject is a reference to:
> 
>   SSL Certificates In Use Today Aren't All Valid
>   http://www.esecurityplanet.com/features/article.php/3890171/SSL-Certificates-In-Use-Today-Arent-All-Valid.htm
> 
> which posits that only 3% of SSL certs in use today are valid.  The figures
> seem a bit suspicious though, for example they claim 23 million SSL sites
> while the same article quotes Netcraft as claiming there are 1.5 million SSL
> certs in use (the Netcraft figures may be for CA-issued certs only, since they
> quote Verisign as a percentage of that total).  Still, 3% seems pretty low,
> could this be due to something like virtual hosting and the client not sending
> the hostname, thereby getting the wrong cert?  Even with that though, I 
> wouldn't have expected a 97% invalidity rate.

>From the quoted article:

"Only about 3.17 percent of the domain names matched," Ristic said.
(Ivan Ristic, director of engineering at Qualys)
is probably about the scan engine to which an URL was posted to the
TLS mailing list a short while ago:

https://www.ssllabs.com/ssldb/index.html

This is based on the seriously flawed assumption that a DNS entry that
can be resolved into an IP-Address of a machine with a Web-Server on
Port 80 will have the same Web-Server on Port 443 if port 443 is active.

Try "www.oracle.com", "www.googlemail.com", "www.gmx.de".
You can get correct answers for "mail.google.com" and "www.gmx.net".

What is really irritating is that a service like "www.hotmail.com"
is not accessible via TLS _at_all_ and suggests you to enter 
username an password into a plain http form -- OUCH!


-Martin