IETF Logo Mail Archive

Re: [TLS] Eleven out of every ten SSL certs aren't valid

Bill Frantz <frantz@pwpconsult.com> Wed, 30 June 2010 00:23 UTC

Return-Path: <frantz@pwpconsult.com>
X-Original-To: tls@core3.amsl.com
Delivered-To: tls@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id CDAE83A68A7 for <tls@core3.amsl.com>; Tue, 29 Jun 2010 17:23:14 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: 0.001
X-Spam-Level:
X-Spam-Status: No, score=0.001 tagged_above=-999 required=5 tests=[BAYES_50=0.001]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id sccEhrqN8PN0 for <tls@core3.amsl.com>; Tue, 29 Jun 2010 17:23:14 -0700 (PDT)
Received: from elasmtp-scoter.atl.sa.earthlink.net (elasmtp-scoter.atl.sa.earthlink.net [209.86.89.67]) by core3.amsl.com (Postfix) with ESMTP id DFCCF3A68A2 for <tls@ietf.org>; Tue, 29 Jun 2010 17:23:13 -0700 (PDT)
Received: from [173.75.83.108] (helo=Bill-Frantzs-MacBook-Pro.local) by elasmtp-scoter.atl.sa.earthlink.net with esmtpa (Exim 4.67) (envelope-from <frantz@pwpconsult.com>) id 1OTl5I-0002pD-Hr; Tue, 29 Jun 2010 20:23:24 -0400
Date: Tue, 29 Jun 2010 17:23:24 -0700
From: Bill Frantz <frantz@pwpconsult.com>
To: Ivan Ristic <ivan.ristic@gmail.com>
X-Priority: 3
In-Reply-To: <AANLkTilFGxsxGs9DD737SvlAL-2x1SLp0iaP2wq0u80p@mail.gmail.com>
Message-ID: <r314ps-1064i-C24C8655809E45CE95A527094AA79DFC@Bill-Frantzs-MacBook-Pro.local>
MIME-Version: 1.0
Content-Type: text/plain; charset="UTF-8"; format="flowed"
Content-Transfer-Encoding: quoted-printable
X-Mailer: Mailsmith 2.2.5
X-ELNK-Trace: 3a5e54fa03f1b3e21aa676d7e74259b7b3291a7d08dfec793087dc3fa6a23a3c64eb8f71d09ff170350badd9bab72f9c350badd9bab72f9c350badd9bab72f9c
X-Originating-IP: 173.75.83.108
Cc: tls@ietf.org
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid
X-BeenThere: tls@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: "This is the mailing list for the Transport Layer Security working group of the IETF." <tls.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/tls>
List-Post: <mailto:tls@ietf.org>
List-Help: <mailto:tls-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/tls>, <mailto:tls-request@ietf.org?subject=subscribe>
X-List-Received-Date: Wed, 30 Jun 2010 00:23:14 -0000

On 6/29/10 at 8:39 AM, ivan.ristic@gmail.com (Ivan Ristic) wrote:

>I have collected about 720K certificates that match the domain names
>from which they were served. I think it's fair to say those are the
>cases where SSL was intended.
>
>Obtaining those certificates was the goal of the first phase of my
>survey. All these other numbers are just a byproduct of that.

I would be interesting to see which trust roots configured in 
current browsers are in actual use in the wild. Your collection 
of certificates could help answer this question, and perhaps 
help remove cruft from browser distributions.

Cheers - Bill

-----------------------------------------------------------------------
Bill Frantz        | OAuth -  It's the best that  | Periwinkle
(408)356-8506      | the wrong way of doing things| 16345 
Englewood Ave
www.pwpconsult.com | can provide. - Mike Stay     | Los Gatos, 
CA 95032

v2.23.0 | Report a Bug | By Email