Re: [TLS] Eleven out of every ten SSL certs aren't valid

[Ivan Ristic <[e-mail]>]

On Tue, Jun 29, 2010 at 8:13 PM, Marsh Ray <[e-mail]> wrote:
> First of all, count me as one who thinks Ivan's work is really cool.
>
> On 06/29/2010 01:29 PM, Ivan Ristic wrote:
>>
>> The problem with that view is that, while the users are experiencing
>> all those sites with invalid certificates they are getting used to the
>> idea that nothing bad comes from browser warnings.
>
> But we don't know that, do we?

Of course we do, from anecdotal evidence. The worst offenders are on
intranets/private hosts everywhere.


> I mean, I can set up a web hosting server with an HTTPS-based "webmin" (or
> whatever admin page I might want to use). I could protect that admin login
> using a cert issued by my own private CA. I could then v-host 1000 non-SSL
> web sites, still using only a single shared IP address.
>
> Doesn't your methodology count this case as "1001 invalid certs" where, in
> reality, everything that is supposed to work is configured correctly?

I disagree that your described setup is working correctly. In my view,
if you delegate a domain name to a server, you should either respond
properly (with the same site) on both 80 and 443, or shut down port
443 if you don't need/want SSL.


> - Marsh

-- 
Ivan Ristic
ModSecurity Handbook [http://www.modsecurityhandbook.com]
SSL Labs [https://www.ssllabs.com/ssldb/]