1# Valid Cert. SSL - Valid certificate SSL 2# Pattern attributes: good notsofast notsofast subset 3# Protocol groups: secure ietf_proposed_standard 4# Wiki: http://www.protocolinfo.org/wiki/SSL 5 6# This matches anything claiming to use a valid certificate from a well 7# known certificate authority. 8# 9# This is a subset of ssl, so it needs to come first to match. 10# 11# Note that opening a website that has a valid certificate will 12# open one connection that matches this and many ssl connections that 13# only match the ssl pattern. Thus, this pattern may not be very useful. 14# 15# This pattern is believed match only the above, but may not match all 16# of it. 17# 18# the certificate authority info is sent in quasi plain text, if it matches 19# a well known certificate authority then we will assume it is a 20# web/imaps/etc server. Other ssl may be good too, but it should fall under 21# a different rule 22 23validcertssl 24^(.?.?\x16\x03.*\x16\x03|.?.?\x01\x03\x01?.*\x0b).*(thawte|equifax secure|rsa data security, inc|verisign, inc|gte cybertrust root|entrust\.net limited) 25