4 ms·

Badssl.com (2017)

40 points by g4zj 3y ago

Retr0id 3y ago
Looks like the cert for extended-validation.badssl.com expired (and not deliberately!) Edit: known issue https://github.com/chromium/badssl.com/issues/516 https://github.com/chromium/badssl.com/issues/516
- Daviey 3y ago
  Same with this, it's a revoked certificate which has expired: https://revoked.badssl.com/ https://revoked.badssl.com/
- stayallive 3y ago
  I am using these now for testing revoked and expired certs: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/ https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls...
matthewmueller 3y ago
Would love a tool that checks your website for these problems.
- jasoncartwright 3y ago
  https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/
- wolfskaempf 3y ago
  You’re in luck because such a tool exists :) https://testssl.sh/ https://testssl.sh/
- creshal 3y ago
  https://www.ssllabs.com/ https://www.ssllabs.com/ covers most (if not all?) server-side problems.
- deleted 3y ago
  [deleted]
- loloquwowndueo 3y ago
  I use sslcheck for this. https://pypi.org/project/sslcheck/ https://pypi.org/project/sslcheck/ Badssl is good to see how clients react to a badly configured certificate, which is a different thing from checking whether your certificate or web site are badly configured.
- efortis 3y ago
  https://Hardenize.com https://Hardenize.com Its founder, Ivan Ristić, has nice books as well.
- stayallive 3y ago
  I felt the same so I've built https://cert.chief.app https://cert.chief.app. Also had to find another source for revoked test certificates for the homepage examples and found them here: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/ https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls.... The badssl ones are expired too which means they are no longer revoked since revocation only lasts the lifetime of the certificates, which makes sense of course.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
GauntletWizard 3y ago
One thing they don't cover is name constraints; There's a bunch of ways that they can fail, and some surprising ways they don't - The default is permit all, so if you have a Web CA with name constraints, you should remember to add poison-pill constraints for e-mail addresses as well. It's of course not super easy for badssl to show such - They'd need an intermediate cert of their own, or close cooperation with a CA, but IRSG should definitely do so.

Badssl.com (2017)

40 points by g4zj 3y ago

Looks like the cert for extended-validation.badssl.com expired (and not deliberately!) Edit: known issue https://github.com/chromium/badssl.com/issues/516 https://github.com/chromium/badssl.com/issues/516

Daviey 3y ago
Same with this, it's a revoked certificate which has expired: https://revoked.badssl.com/ https://revoked.badssl.com/
stayallive 3y ago
I am using these now for testing revoked and expired certs: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/ https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls...

matthewmueller 3y ago

Would love a tool that checks your website for these problems.

jasoncartwright 3y ago
https://www.ssllabs.com/ssltest/ https://www.ssllabs.com/ssltest/
wolfskaempf 3y ago
You’re in luck because such a tool exists :) https://testssl.sh/ https://testssl.sh/
creshal 3y ago
https://www.ssllabs.com/ https://www.ssllabs.com/ covers most (if not all?) server-side problems.
deleted 3y ago
[deleted]
loloquwowndueo 3y ago
I use sslcheck for this. https://pypi.org/project/sslcheck/ https://pypi.org/project/sslcheck/ Badssl is good to see how clients react to a badly configured certificate, which is a different thing from checking whether your certificate or web site are badly configured.
efortis 3y ago
https://Hardenize.com https://Hardenize.com Its founder, Ivan Ristić, has nice books as well.
stayallive 3y ago
I felt the same so I've built https://cert.chief.app https://cert.chief.app. Also had to find another source for revoked test certificates for the homepage examples and found them here: https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls-certificates/ https://www.ssl.com/sample-valid-revoked-and-expired-ssl-tls.... The badssl ones are expired too which means they are no longer revoked since revocation only lasts the lifetime of the certificates, which makes sense of course.

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

deleted 3y ago

[deleted]

GauntletWizard 3y ago

One thing they don't cover is name constraints; There's a bunch of ways that they can fail, and some surprising ways they don't - The default is permit all, so if you have a Web CA with name constraints, you should remember to add poison-pill constraints for e-mail addresses as well. It's of course not super easy for badssl to show such - They'd need an intermediate cert of their own, or close cooperation with a CA, but IRSG should definitely do so.