Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Ivan Ristic <[e-mail]>]

On Tue, Jun 29, 2010 at 11:21 PM, Marsh Ray <[e-mail]> wrote:
> On 06/29/2010 04:44 PM, Ivan Ristic wrote:
>>
>> On Tue, Jun 29, 2010 at 10:40 PM, Marsh Ray<[e-mail]>
>> wrote:
>>>
>>> ...
>>>
>>> I liked the suggestion about looking for https: links on the net.
>>> Scores could even be weighted by incoming links, a' la pagerank. If
>>> a dns name really has zero links to it, it's questionable whether
>>> or not its really relevant as a part of the web.
>>
>> Isn't that exactly what we'd be getting from looking at the most
>> popular 1 million domain names?
>
> Perhaps, but I would want a precise definition of "most popular" before
> agreeing to the "exactly". :-)

My understanding is that Alexa (http://www.alexa.com) uses the toolbar
to record where people go on the Internet. They then use that data to
maintain the list of most popular web sites.

In the light of yesterdays bashing on the metrics, I am starting to
like Alexa's list more and more, because it's not only much easier to
monitor (1M sites and about 110K certificates with matching names),
but makes more sense.


> From TFA:
>>
>> "Only about 3.17 percent of the domain names matched," Ristic said.
>> "So we have about 22 million SSL servers with certificates that are
>> completely invalid because they do not match the domain name on which
>> they reside."
>
> This is where I think there's some room for legitimate discussion about the
> numbers as presented.
>
> Is it correct to count a server reached from a misdirected DNS entry as
> "completely invalid" SSL?

The way I see it, it's a fact. There is no way for someone to know if
a domain name wants SSL. (It's a separate topic, but I think there
should be. Just as there should be a way for a domain name to say it
wants _only_ SSL.)

I make not claim that all those domain names "intended" to run SSL,
but in fact they do. People focus on the negatives, because they make
nice headlines, but I want to know how many domain names _do_ run SSL
properly.


> According to the RFCs as I understand them, we can only say (an otherwise
> well-formed) cert is invalid in the context of a protocol, an requested
> identity, a set of trusted root certs, a time of validation, etc. We all
> know there's a good deal of variation in clients' trusted roots. Revocation
> data could be another interesting contextual variable.
>
> - Marsh

-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]