Re: [TLS] Eleven out of every ten SSL certs aren't valid

[[e-mail]]

On Tue, Jun 29, 2010 at 2:24 PM, Nicolas Williams <[e-mail]> wrote:
> On Tue, Jun 29, 2010 at 05:10:30PM -0400, Tim Dierks wrote:
>> On Tue, Jun 29, 2010 at 4:46 PM, Nicolas Williams <
>> [e-mail]> wrote:
>> > The context was just how awful it is that 97% of servers don't have
>> > valid certs
>>
>> That is not what is being said. What is being said is that 97% of DNS names
>> that point at SSL servers do not validate with those DNS names. This is, on
>> its face, is a statement about DNS configuration, not about SSL servers.
>
> Ah, pardon my evidently too-cursory read.  I'd like to see a breakdown
> by HTTP/1.0 versus HTTP/1.1 then (since the latter supports
> virtualization while the former does not).

If you'd care to look at the Apache documentation on vhosts, you'll see:

As mentioned earlier, there are some clients who do not send the required data for the name-based virtual hosts to work properly. These clients will always be sent the pages from the first virtual host listed for that IP address (the primary name-based virtual host).

How much older?
Please note that when we say older, we really do mean older. You are very unlikely to encounter one of these browsers in use today. All current versions of any browser send the Host header as required for name-based virtual hosts.

>> (Creating a thousand DNS names for the IP address of a single SSL server
>> will change this stat, although the owner and operator of the SSL server
>> need not be involved in any way.)
>
> Right.  One might want to consider only all the names for any one server
> that come from the same zone file as the server's addresses' canonical
> domainnames.

...er, that would also cause a problem.  The CNAME that my externally-hosted virtual machine's IP resolves to is not one of my domains, but all of my domains point to the same virtual machine's IP.

>> To learn anything interesting about SSL servers at all, more work must be
>> done.
>
> In particular it's important to distinguish sites that serve HTTPS just
> because from sites that serve HTTPS because they really ought to, and
> from sites that serve HTTPS as part of being attack sites.

I serve HTTPS and I do not serve HTTP.  If I get an HTTP request I only RewriteRule (.*) https://my.vhost.name/$1 [R=301].

> If it turns out that 97% of sites that accept credit card payments have
> invalid certs (in some way or another), then we'd definitely have a
> problem.  I suspect that's not the case though.

I expect that this is a major move of "sleight of hand" to distract us from a more serious threat: that many sites that accept credit card payments have domain-validated certificates, with no true ownership information.

-Kyle H