IETF Logo Mail Archive

Re: [TLS] Eleven out of every ten SSL certs aren't valid

Tim Dierks <tim@dierks.org> Tue, 29 June 2010 21:22 UTC

Return-Path: <tdierks@gmail.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3BACC3A69CC for <tls@core3.amsl.com>; Tue, 29 Jun 2010 14:22:08 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -1.976
X-Spam-Level:
X-Spam-Status: No, score=-1.976 tagged_above=-999 required=5 tests=[BAYES_00=-2.599, FM_FORGED_GMAIL=0.622, HTML_MESSAGE=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id yqR0xLiNyuxi for <tls@core3.amsl.com>; Tue, 29 Jun 2010 14:22:07 -0700 (PDT)
Received: from mail-iw0-f172.google.com (mail-iw0-f172.google.com [209.85.214.172]) by core3.amsl.com (Postfix) with ESMTP id B030C3A696D for <tls@ietf.org>; Tue, 29 Jun 2010 14:22:06 -0700 (PDT)
Received: by iwn40 with SMTP id 40so91004iwn.31 for <tls@ietf.org>; Tue, 29 Jun 2010 14:22:17 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=domainkey-signature:received:mime-version:sender:received :in-reply-to:references:from:date:x-google-sender-auth:message-id :subject:to:cc:content-type; bh=ZS8vgjPPLLAmfLl6hfeYls8qN3YAns3zCzkUbeAHP9M=; b=uSCyx4htQ+LJWeIEPVq2fwKkysJSp4Isyf3SDrtAptSnoD1dMnxyqZo+eNyvYWa5q9 F/WtzPaOtvnTBWCCx2KwwCpnkXRgGVLfA+Yx6jyeCne2PVaiXQB9X+KeGdZZwBy3SdLr /4i4UyNhnWA3Ebzqy9/yYVXG5pEfXONWRwjh0=
DomainKey-Signature: a=rsa-sha1; c=nofws; d=gmail.com; s=gamma; h=mime-version:sender:in-reply-to:references:from:date :x-google-sender-auth:message-id:subject:to:cc:content-type; b=IFXTPtTYl80Rf4ahYe4eBL6G/nidW6VFAF2R4mXOBAt5+nYQ/cnOhMb6bnadRP61vb V5yc5vrfr1+Nra+GMf8GeLsQEd2vWbSCIgZL+rMTXzY/j/0dPH9LGBPzeO8uu2u/g7Xa 1B82vK3WGZHs0rvEHEVdflXLbgTTX9z1dMByE=
Received: by 10.231.79.67 with SMTP id o3mr7814339ibk.132.1277846533986; Tue, 29 Jun 2010 14:22:13 -0700 (PDT)
MIME-Version: 1.0
Sender: tdierks@gmail.com
Received: by 10.231.148.2 with HTTP; Tue, 29 Jun 2010 14:21:53 -0700 (PDT)
In-Reply-To: <AANLkTinCMFMW0VHjL3AyetcqGgrEtGsO1nSqyQS45lX8@mail.gmail.com>
References: <E1OTVaY-0004g3-OW@wintermute02.cs.auckland.ac.nz> <20100629163354.GR11785@oracle.com> <AANLkTim6sYWlPSRUwYHP4UfkUNkfiVQ7xbj28fF6fOmz@mail.gmail.com> <4C2A45C9.3010608@extendedsubset.com> <AANLkTinHVJGrnBl93qCfrrbHGlTP_yEMX8PMRduSIKgd@mail.gmail.com> <20100629203546.GW11785@oracle.com> <AANLkTinCMFMW0VHjL3AyetcqGgrEtGsO1nSqyQS45lX8@mail.gmail.com>
From: Tim Dierks <tim@dierks.org>
Date: Tue, 29 Jun 2010 17:21:53 -0400
X-Google-Sender-Auth: fVQqdfhMsg4J86BvK8XkcJgTBnE
Message-ID: <AANLkTikWtwMixaB2tFMoccz8UW9XZtR_9SAYw1cdeGZZ@mail.gmail.com>
To: Ivan Ristic <ivan.ristic@gmail.com>
Content-Type: multipart/alternative; boundary="0016e647568cbc5a7e048a31d413"
Cc: tls@ietf.org
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Tue, 29 Jun 2010 21:22:08 -0000

On Tue, Jun 29, 2010 at 5:18 PM, Ivan Ristic <ivan.ristic@gmail.com> wrote:

> Nico, forgive me for not answering your questions, but I don't have
> enough time to give them justice.
>
> In brief, I am not demanding nor proposing anything. I am just
> measuring. If you can think of a better way to measure things, I will
> be all ears.
>

I would suggest you crawl the web for invalid links (https links that point
to servers with invalid certificates), or find SSL servers which are not
available at the DNS servers named in their certificates.

 - Tim

v2.23.0 | Report a Bug | By Email