Comodo SSL Urges Clarification in the Preliminary Published Findings From a Qualys Certificate MarketPlace Study
Jersey City, NJ, July 1, 2010 – Comodo urges Qualys and Ivan Ristic, director of engineering at the security research firm to clarify his recent statements made during a webcast and reported by eSecurity Planet.com regarding Qualys upcoming marketplace study on SSL deployments and their shortcomings.
Based on Mr. Ristic’s published comments, Comodo believes that the study will overestimate the number of SSL certificates and incorrectly state the number of those SSL certificates that are invalid because they do not match the domain name on which they reside.
“The methodology of the study is unclear and the paper, once published, could misrepresent the true SSL market and industry, judged by the statements made to the public already“, according to Melih Abdulhayoglu, chief executive officer of Comodo.
Ristic’s assertion that “only 23 million of the sites were actually running SSL“, is a great miscalculation because commercial Certificate Authorities have sold substantially fewer than 23 million certificates, according to Comodo.
The claim that 22 out of 23 million SSL servers with certificates in use today are not configured correctly is also a distortion. “Stating that nearly 97 percent of certificates are invalid because they don’t match the domain name is simply incorrect – the majority of those SSL certificates were never acquired for that domain name.” Abdulhayoglu said.
For example, a webhost may host 100 domain names on a single IP address. Of those, just three sites are SSL enabled, while the other 97 are not. The Qualys study would suggest that there are 100 SSL enabled sites with 97 domains misconfigured due to mismatch of the domain name. Yet, only three domains at that IP address are actually configured for the SSL certificate, while the remaining 97 are not configured for SSL at all.
Comodo believes this over-reporting of ‘misconfigured’ sites would be a disservice to the general public, could damage the reputations of ISPs, webhosts and Certificate Authorities, and ultimately, could have a detrimental effect on e-commerce.
“Ivan Ristic is an experienced security researcher and is held in high regard by all at Comodo” Abdulhayoglu continued, “but these interim figures paint an inaccurate picture of SSL deployment because they are not properly clarified. We urge him to review these figures before publishing or presenting this to an informed audience.”
Comodo has published its latest marketshare findings on whichssl.com, and has also released an SSL Analyzer tool currently in Beta, available at sslanalyzer.comodoca.com/. These resources are free to the public and help organizations and individuals evaluate their SSL certificates and verify their configuration in order to comply with PCI requirements.
About Comodo
Comodo® is a leading brand in Internet security. With United States headquarters in New Jersey and global resources in the United Kingdom, China, India, Ukraine, and Romania, Comodo provides businesses and consumers worldwide with security and trust services, including digital certificates, PCI scanning, desktop security, and remote PC support. Securing online transactions for over 200,000 businesses, and with more than 25 million desktop security software installations, including an award-winning Firewall and Antivirus software, Comodo is Creating Trust Online®. To learn more, visit Comodo’s website
For more information, reporters and analysts may contact:
Robin Carley
Corporate Communications and Public Relations
Office: 201-963-0004 x 4073
E-Mail: robin.carley@comodo.com
