The EFF SSL Observatory

Multihomed web servers would be impossible to secure with your scheme of accepting the cert for site.com just because it was given to me by the site sitte.com which resolves to the same ip. I hope you see the problem with that.

For situations like the one you described it's better to buy wildcard certificates since you then can use the same certificate for *.domain.com

Unfortunately a wildcard cert for *.domain.com does not protect domain.com itself though, perhaps for good reasons I don't know.

What's astonishing is that they get signed

Imagine if you went to a local notary public, perhaps a magistrate say, and asked them to sign paperwork authenticating pictures of a generic clothing model as being pictures of you for a passport application.

What would be astonishing is not that you might do this, but that a magistrate (in this case, practically all the magistrates) would sign the paperwork. The pictures are cut from a magazine!

Even more astonishing would be if these same magistrates, who are clearly incompetent, were to object to a new policy of allowing bakers and gardeners to act as notary publics on the basis that such people lack the skills.

The CAs which have been shown to be utterly incompetent in this analysis are strongly against allowing non-traditional organisations to act as CAs. But we see that in fact they'll allow anyone into the game - so long as they pay a high fee. Not only banks, dubious national governments, and the military, but also supermarkets.

For years people have been scared about rogue CAs. But rogue CAs have never been proved to exist. What definitely does exist is incompetent CAs. Indeed it appears that all or most of the major CAs are incompetent. In many ways an incompetent CA is worse, because if we identified a rogue CA the upstream vendors would all remove that CA from their trust network, and eventually things would get better. But we know that everybody turns a blind eye to the incompetence. Spooks and organised criminals don't need to run their own rogue CA, they can just send fake headed notepaper to Verisign and get a cert issued in the name of any organisation in the world.

Seriously though, for internal-only sites, why not deploy your own CA cert, so you can easily issue certs with subjectAltName's matching the short name, the IP address etc. Or, look for a commercial CA that will allow that (which could be more work than the previous option :-().