Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Ivan Ristic <[e-mail]>]

I forgot to mention another thing: when I looked at the Alexa's top 1M
sites, 27.86% of all certificates matched the domain name.


On Tue, Jun 29, 2010 at 2:31 PM, Ivan Ristic <[e-mail]> wrote:
> The numbers in the article come from the preview of my research, which
> I presented in a webcast last Thursday. Here's the summary of the
> presentation:
>
> 1. I started with 119M domain names (out of 193M registered
> worldwide). The 119M include all .com, .org, .net, .info, .biz, and
> .us domain names.
> 2. 92M domains are active on port 80 or port 443
> 3. 33M domains have port 443 open
> 4. 22.65M domain names run SSL on port 443
> 5. On 0.72M domain names certificates match the domain name.
>
> I am now focusing on the 720K certificates that are potentially valid.
>
> Once I find out exactly how many of those certificates are valid, I
> will make two claims:
>
> - X% of web servers properly run SSL (where X will be < 3%)
> - Y% of certificates are valid (where Y will be significantly higher than > 3%)
>
> I should be able to post my presentation online tomorrow, after which
> I will follow-up here.
>
> BTW, my assessment methodology is available on
> https://www.ssllabs.com, along with an online assessment tool (that
> works with a single hostname). There's additional material on the SSL
> Labs mailing list. I will publish the complete report in about a
> month.
>
> I welcome all feedback, as well as deeper involvement if you're
> interested in the topic.
>
> Cheers,
> Ivan
>
> On Tue, Jun 29, 2010 at 8:50 AM, Peter Gutmann
> <[e-mail]> wrote:
>> In case someone here still hasn't seen this, the subject is a reference to:
>>
>>  SSL Certificates In Use Today Aren't All Valid
>>  http://www.esecurityplanet.com/features/article.php/3890171/SSL-Certificates-In-Use-Today-Arent-All-Valid.htm
>>
>> which posits that only 3% of SSL certs in use today are valid.  The figures
>> seem a bit suspicious though, for example they claim 23 million SSL sites
>> while the same article quotes Netcraft as claiming there are 1.5 million SSL
>> certs in use (the Netcraft figures may be for CA-issued certs only, since they
>> quote Verisign as a percentage of that total).  Still, 3% seems pretty low,
>> could this be due to something like virtual hosting and the client not sending
>> the hostname, thereby getting the wrong cert?  Even with that though, I
>> wouldn't have expected a 97% invalidity rate.
>>
>> Peter.
>> _______________________________________________
>> TLS mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/tls
>>
>
> --
> Ivan Ristic
> ModSecurity Handbook [http://www.modsecurityhandbook.com]
> SSL Labs [https://www.ssllabs.com/ssldb/]
>



-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]