Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Nicolas Williams <[e-mail]>]

On Tue, Jun 29, 2010 at 05:10:30PM -0400, Tim Dierks wrote:
> On Tue, Jun 29, 2010 at 4:46 PM, Nicolas Williams <
> [e-mail]> wrote:
> > The context was just how awful it is that 97% of servers don't have
> > valid certs
> 
> That is not what is being said. What is being said is that 97% of DNS names
> that point at SSL servers do not validate with those DNS names. This is, on
> its face, is a statement about DNS configuration, not about SSL servers.

Ah, pardon my evidently too-cursory read.  I'd like to see a breakdown
by HTTP/1.0 versus HTTP/1.1 then (since the latter supports
virtualization while the former does not).

> (Creating a thousand DNS names for the IP address of a single SSL server
> will change this stat, although the owner and operator of the SSL server
> need not be involved in any way.)

Right.  One might want to consider only all the names for any one server
that come from the same zone file as the server's addresses' canonical
domainnames.

> To learn anything interesting about SSL servers at all, more work must be
> done.

In particular it's important to distinguish sites that serve HTTPS just
because from sites that serve HTTPS because they really ought to, and
from sites that serve HTTPS as part of being attack sites.

If it turns out that 97% of sites that accept credit card payments have
invalid certs (in some way or another), then we'd definitely have a
problem.  I suspect that's not the case though.

Nico
--