Badssl.com (2017)

badssl.com

40 points·g4zj··11 comments

One thing they don't cover is name constraints; There's a bunch of ways that they can fail, and some surprising ways they don't - The default is permit all, so if you have a Web CA with name constraints, you should remember to add poison-pill constraints for e-mail addresses as well.

It's of course not super easy for badssl to show such - They'd need an intermediate cert of their own, or close cooperation with a CA, but IRSG should definitely do so.

Looks like the cert for extended-validation.badssl.com expired (and not deliberately!)

Edit: known issue https://github.com/chromium/badssl.com/issues/516

Same with this, it's a revoked certificate which has expired: https://revoked.badssl.com/

I am using these now for testing revoked and expired certs: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls...

Would love a tool that checks your website for these problems.

https://www.ssllabs.com/ssltest/

You’re in luck because such a tool exists :) https://testssl.sh/

https://www.ssllabs.com/ covers most (if not all?) server-side problems.

I use sslcheck for this. https://pypi.org/project/sslcheck/

Badssl is good to see how clients react to a badly configured certificate, which is a different thing from checking whether your certificate or web site are badly configured.

https://Hardenize.com

Its founder, Ivan Ristić, has nice books as well.

I felt the same so I've built https://cert.chief.app.

Also had to find another source for revoked test certificates for the homepage examples and found them here: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls.... The badssl ones are expired too which means they are no longer revoked since revocation only lasts the lifetime of the certificates, which makes sense of course.

Reply on news.ycombinator.com