Subject: [certid] weird CN-IDs (subjectCommonName) in SSL Labs Survey Data

From: =JeffH <[email-masked]>
Date: Sat, 16 Oct 2010 21:40:44 -0700

>> all 867361 have a "CN=" in the subject name (CN-ID).
 >
 > I'd be curious how many have Common Names that are intended to be DNS
 > domain names like "www.example.com" and how many have plain old names
 > like "Example Systems, Inc.".

Ok, I extracted all CN-IDs (subjectCommonName) in SSL Labs Survey Data, hacked 
up a regex, wrapped it with some perl, and found there's 1151 "weird" CN-ID 
values in the data ( 0.13% ). These are string values that don't match a regex 
describing a optional-whitespace-wrapped LDH (Letter-Digit-Hyphen) domain name 
(note that an IDN won't match this (one's included below)).

Some examples highlighting the variety of types I observe when browsing the 
"weird" CN-ID values are below. Note that I didn't try verifying this data (eg 
by checking that the subjectCommonName column matched the CN attributes value 
in the subject column in the dbase table, nor by going and querying the servers 
and verifying the cert returned matches the dbase entries).

=JeffH

  ALL IN ONE services.acheckamerica.com suite.agile1.com www.etimeentry.com ALL 
IN ONE

  iNDivia.net Net Services

  incelis Inc.

  intranet.zsi.at bibliothek.intranet.zsi.at webmail.intranet.zsi.at 
wiki.intranet.zsi.at ztools.intranet.zsi.at 

  HTTP TLS/SSL Certificate

self-signed Marty Ledgerwood www.southvalleywealth.org rsa-key 5418825488 
0162022008002919 68.185.19.85

  Exchange Wildcard

  *.bluevalleyk12.org schoolcenter.bluevalleyk12.org www.bluevalleyk12.org

  (www|zeus).asap-solution.com

  193.46.210.226 serveco-ua.com

  thenamelessdomain Server Certificate

  www.ÙØ³ØªØ¶ÙÙ-ÙÙÙ.com

  Yandex Serp

  PACKAGING TAPE www.airmovers.com www.carpetextractors.com www.cleanfreak.com 
www.floorbuffers.com www.floorscrubbers.com www.packagingtapeinc.com 
www.ptipackaging.com PACKAGING TAPE 

  Yandex Tiny Corba Services

  www.cebbank.com+2.5.4.5=#130f313030303030303030303131373438

THE INTERNATIONAL SOCIETY FOR TRAUMATIC STRESS STUDIES istss.info istss.org 
www.istss.org THE INTERNATIONAL SOCIETY FOR TRAUMATIC STRESS STUDIES

ownitsch.de HTTPS Certificate
 
\x00*\x00.\x00p\x00s\x00e\x00a\x00l\x00o\x00c\x00a\x00l\x00s\x00.\x00o\x00r\x00g

SOCIETY OF VERTEBRATE PALEONTOLOGY vertpaleo.info vertpaleo.org 
www.vertpaleo.org SOCIETY OF VERTEBRATE PALEONTOLOGY

NET LOGISTICS PTY. LTD. secure.netlogistics.com.au www.netlogistics.com.au 
www.turboservers.com.au NET LOGISTICS PTY. LTD.

  PLATINUM ACQUISITIONS www.4closureprofits.com www.4closures4profit.com 
www.4ecloser.com www.bestdealsonforeclosures.com 
www.bspeaksforeclosesureinvest.com www.easyforeclosurefortune.com 
www.easyforeclosureinvestingsecretsrevealed.com 
www.easyforeclosurestrategies.com www.easystreetforeclosureinvesting.com 
www.estatereposite.com www.fastcashforeclosures.com 
www.forecloserinvestment101.com www.foreclosesimpleinvest.com 
www.foreclosure-investoptions.com www.foreclosurebeyond.com 
www.foreclosurecashsecrets.com www.foreclosurecottage.com 
www.foreclosureforprofits.com www.foreclosureinformations.com 
www.foreclosureinvestingforyou.com www.foreclosureinvestor5000.com 
www.foreclosurepatriot.com www.foreclosureprosperity.com www.foreclosureque.com 
www.foreclosurerewards.com www.foreclosures-pal.com www.foreclosures4agrand.com 
www.foreclosureuniversal.com www.foxforeclosureinvesting.com 
www.freesimpleforeclosure.com www.grandforeclosureinvesting.com 
www.homesforeclosuresale.com www.hugeforclosureprofit.com 
www.investforclosure.com www.investinforeclosurestoday.com 
www.investinginewforeclosures.com www.investinginfoforeclosures.com 
www.investingnforclosures.com www.investingwithforeclosures.com 
www.newforeclosureinfo.com www.newsecretforeclosures4less.com 
www.power-fore-closures.com www.profitfromforeclosure.com 
www.reclaimproperties.com www.riskfreeforeclosurefortunes.com 
www.seforclosures.com www.simple4closureinvesting.com 
www.simpleforeclosureinvest.com www.topforeclosuredata.com 
www.unlockthevaultforeclosers.com www.winwininforeclosures.com PLATINUM 
ACQUISITIONS 

---
end

---

From: Martin Rex <[email-masked]>
Date: Mon, 18 Oct 2010 15:24:01 +0200 (MEST)

>   www.cebbank.com+2.5.4.5=#130f313030303030303030303131373438

This is a correct CN-ID,
with a RDName that contains two attribute-value pairs, CN + SerialNumber

The plus instead of the comma indicates that attributes are part
of the same RDName.

-Martin

---

From: Matt McCutchen <[email-masked]>
Date: Mon, 18 Oct 2010 13:40:19 -0400

> The plus instead of the comma indicates that attributes are part

I guess this is a bug in the parser used for the survey: it assumed that
an RDN starting with "CN=" contained only a CN and did not properly
split multiple AVAs.

-- 
Matt