Jules8850

I've also seen this spider, and upon close examination it appears to be using a large dump of URLs, many years old, including non-public, non-guessable URLs that could only have been harvested from some sort of browser/plugin data breach.

Most likely the browser would not complain; it will block, fetch the intermediate certificates (if possible), verify the signatures, then proceed. So probably just a performance hit in most cases.

Full explanation here: https://www.wormly.com/help/ssl-tests/intermediate-cert-chai...

Specifically on the edge server we hit in that particular test (69.171.228.13), they haven't installed their intermediate certificate chain.

Allowing insecure re-negotiation isn't too crash hot, either.