Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid

From: "Jeffrey A. Williams" <[email-masked]>
Date: Tue, 29 Jun 2010 17:30:38 -0500 (GMT-05:00)

Uri and all,

I also concur.  There are simply too many questionable certification authorities issuing

false or usless Certs and have been for some years now.

-----Original Message-----
From: "Blumenthal, Uri - 0668 - MITLL"
Sent: Jun 29, 2010 9:48 AM
To: Tim Dierks , Ivan Ristic
Cc: "[email-masked]"
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid

On 6/29/10 10:36 , "Tim Dierks" <[email-masked]> wrote:
>  On Tue, Jun 29, 2010 at 10:15 AM, Ivan Ristic <[email-masked]> wrote:
>> If you're referring to my work, I didn't make any assumptions.
>> I merely reported the findings, which are that  about 3.17% of domain
>> names that respond with SSL on port 443 have a potentially valid
>> certificate.
>
> In my opinion, this is a pretty meaningless statistic.

I concur.
--
Regards,
Uri         [email-masked]
<Disclaimer>

Regards,

Jeffrey A. Williams
Spokesman for INEGroup LLA. - (Over 300+k members/stakeholders and growing, strong!)
"Obedience of the law is the greatest freedom" -
Abraham Lincoln

"Credit should go with the performance of duty and not with what is very
often the accident of glory" - Theodore Roosevelt

"If the probability be called P; the injury, L; and the burden, B; liability
depends upon whether B is less than L multiplied by
P: i.e., whether B is less than PL."
United States v. Carroll Towing  (159 F.2d 169 [2d Cir. 1947]
===============================================================
Updated 1/26/04
CSO/DIR. Internet Network Eng. SR. Eng. Network data security IDNS. div. of
Information Network Eng.  INEG. INC.
ABA member in good standing member ID 01257402 E-Mail [email-masked]
Phone: 214-244-4827

---

From: "Blumenthal, Uri - 0668 - MITLL" <[email-masked]>
Date: Wed, 30 Jun 2010 07:51:14 -0400

Again, I second this.

Regards,
Uri

----- Original Message -----
From: [email-masked] <[email-masked]>
To: Bill Frantz <[email-masked]>
Cc: [email-masked] <[email-masked]>
Sent: Tue Jun 29 20:29:22 2010
Subject: Re: [TLS] Eleven out of every ten SSL certs aren't valid

On Tue, Jun 29, 2010 at 05:23:24PM -0700, Bill Frantz wrote:
> On 6/29/10 at 8:39 AM, [email-masked] (Ivan Ristic) wrote:
> 
> >I have collected about 720K certificates that match the domain names
> >from which they were served. I think it's fair to say those are the
> >cases where SSL was intended.
> >
> >Obtaining those certificates was the goal of the first phase of my
> >survey. All these other numbers are just a byproduct of that.
> 
> I would be interesting to see which trust roots configured in
> current browsers are in actual use in the wild. Your collection of
> certificates could help answer this question, and perhaps help
> remove cruft from browser distributions.

Excellent idea!

Nico
-- 
_______________________________________________
TLS mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/tls

---

From: [email-masked]
Date: Wed, 30 Jun 2010 14:08:35 -0700 (PST)

On Tue, Jun 29, 2010 at 8:43 AM, Joshua Davies <[email-masked]> wrote:

Well, ok, but... why listen on port 443 if you don't plan to support
SSL in the first place?  I doubt that oracle.com is being run from a
shared-hosting site.  Most likely it's Akamai that's doing something
that doesn't mix well with TLS; Oracle may not care, but this, I would
think, would be of some interest to the IETF TLS working group...

Does it matter if someone decides to use 443 for a purpose other than HTTP with TLS/SSL transport?

And besides, the entire concept of "valid certificates" isn't exactly one for [email-masked], it's one for [email-masked].  The people who have created a protocol which has a mode where neither party authenticates itself should not be held liable for sites that choose not to authenticate themselves in a manner based on an *informational* RFC.

-Kyle H

---

From: [email-masked]
Date: Wed, 30 Jun 2010 14:25:17 -0700 (PST)

On Tue, Jun 29, 2010 at 1:22 PM, Ivan Ristic <[email-masked]> wrote:
>> I mean, I can set up a web hosting server with an HTTPS-based "webmin" (or
>> whatever admin page I might want to use). I could protect that admin login
>> using a cert issued by my own private CA. I could then v-host 1000 non-SSL
>> web sites, still using only a single shared IP address.
>>
>> Doesn't your methodology count this case as "1001 invalid certs" where, in
>> reality, everything that is supposed to work is configured correctly?
>
> I disagree that your described setup is working correctly. In my view,
> if you delegate a domain name to a server, you should either respond
> properly (with the same site) on both 80 and 443, or shut down port
> 443 if you don't need/want SSL.

If he wants to avoid a childporn site being set up on his server, you had better bet he's only going to submit his credentials to create a new site across an encrypted connection.

The problem that you're not seeing is this: computers do not see themselves as names.  Physical interfaces don't have public names, other than their IP addresses.

DNS is not associated with computer interfaces, it's a means of taking a *name* and changing it to an *IP address*, very much like a distributed directory.  The computer has no sense of what names are pointed to it, and DNS doesn't care if there are any services presented by the computer it's pointing to -- or even *what* those services might be.  We have _mscds.domain.name.here and TXT records with semantics different from their original meaning pointing to services, when dealing with multicast DNS -- but even then, that's all management, that's not inherent to the protocol.

If I delegate 2000 name-based virtual host configurations to a server, and I only want to administer it via TLS (possibly/probably with client-certificate authentication, to prevent *anyone* else from screwing with it), I still have to leave port 443 open for that one purpose -- and with places like myhosting.com, the administration that I can perform occurs via the same public IP.

So, I accept your "should" as the RFC states: Implementors are "strongly encouraged" to do this, but they are not "mandated" to do this.  There do exist many configurations outside of your concept of "a separate physical administrative interface".  There is no way to say "only open port 443 if it's accessed by this name".

Your numbers are worse than meaningless, they are simply noise.

-Kyle H

---

From: =JeffH <[email-masked]>
Date: Wed, 30 Jun 2010 19:11:42 -0700

Hi Peter,

 > the figure is very meaningful
 > because it supports the analysis of the effects of externalities on web site
 > security done by some guys at Microsoft Research a few months ago which
 > pointed out that since certificate warnings are close to one hundred percent
 > false positives (they were aware of no known cases in which someone had been
 > saved from being phished by a cert warning), the effect of a true positive is
 > rendered void.

Might you please post a link to the particular paper you're citing here (or 
authors & title at least)?

thanks,

=JeffH