Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Nicolas Williams <[e-mail]>]

On Tue, Jun 29, 2010 at 09:22:50PM +0100, Ivan Ristic wrote:
> On Tue, Jun 29, 2010 at 8:13 PM, Marsh Ray <[e-mail]> wrote:
> > I mean, I can set up a web hosting server with an HTTPS-based "webmin" (or
> > whatever admin page I might want to use). I could protect that admin login
> > using a cert issued by my own private CA. I could then v-host 1000 non-SSL
> > web sites, still using only a single shared IP address.
> >
> > Doesn't your methodology count this case as "1001 invalid certs" where, in
> > reality, everything that is supposed to work is configured correctly?
> 
> I disagree that your described setup is working correctly. In my view,
> if you delegate a domain name to a server, you should either respond
> properly (with the same site) on both 80 and 443, or shut down port
> 443 if you don't need/want SSL.

Do you consider an otherwise valid (unexpired, ...) self-signed cert to
be valid?  What if it's not pre-shared to you?

Do you consider an otherwise valid cert to be invalid if you have no
validation path for it to a CA you trust?  What if someone else can find
a validation path for it to a CA _they_ trust?

Surely it would be fine to have servers that by default generate
self-signed certs and use those for HTTPS.  Or do you disagree?  Do you
reject the use of pre-sharing of certs?  Do you demand that we all use
actual PKIs?

Nico
--