Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Tim Dierks <[e-mail]>]

On Tue, Jun 29, 2010 at 10:15 AM, Ivan Ristic <[e-mail]> wrote:

> If you're referring to my work, I didn't make any assumptions. I
> merely reported the findings, which are that  about 3.17% of domain
> names that respond with SSL on port 443 have a potentially valid
> certificate.
>

In my opinion, this is a pretty meaningless statistic. There's no warranty
that just because a domain name maps to an IP address and that IP address
has an SSL server that the SSL server will respond with a certificate that
matches the domain name in question. If I go and register a thousand domain
names and give each one a CNAME that points to www.modsecurity.org, and you
go and find it serves SSL on 443, but doesn't present the certificates for
my domains, so this percentage goes down, what does that mean? Nothing at
all.

If you had a statistic about what fraction of https:// links on the Internet
point to misconfigured servers, that would be more interesting.

 - Tim