Bad SSL

#1

Post by aburan28 » Sat, Mar 18, 2017, 8:30 AM UTC

Bad SSL
badssl.com

Re: Bad SSL

#2

Post by Handgemenge » Sat, Mar 18, 2017, 11:36 AM UTC

https://www.sslshopper.com/ssl-checker.html comes to mind

Re: Bad SSL

#3

Post by popey456963 » Sat, Mar 18, 2017, 11:40 AM UTC

Handgemenge wrote: post #2

https://www.sslshopper.com/ssl-checker.html comes to mind

I'm actually more of a fan of https://www.ssllabs.com/ssltest/analyze.html - it gives you a whole lot more information (although does take longer).

Re: Bad SSL

#4

Post by buhrmi » Sat, Mar 18, 2017, 11:40 AM UTC

this must be really useful when developing your own browser

Re: Bad SSL

#5

Post by Walkman » Sat, Mar 18, 2017, 11:40 AM UTC

Last week I made a comparison matrix against Badssl.com for different Crypto libs on OS X: https://gist.github.com/kissgyorgy/54601c883891991f28e49ac1b...

Re: Bad SSL

#6

Post by FiloSottile » Sat, Mar 18, 2017, 11:54 AM UTC

An incredibly useful resource, well maintained by some of the best people in the PKI space, recently quoted by US-CERT [1] and so quick to use that I try it before starting to use any browser.

A year ago it made me find out that the most popular iOS Tor browser doesn't check certificates at all. [2] (Use OnionBrowser instead.)

[1] https://www.us-cert.gov/ncas/alerts/TA17-075A [2] https://twitter.com/FiloSottile/status/765230315132559360

For an easter egg, try to click on "Defunct"...

Re: Bad SSL

#7

Post by raverbashing » Sat, Mar 18, 2017, 12:00 PM UTC

Good concept, but the usability is bad

If you see the dashboard things are clearer, but there's a mismatch between connected/not connected and what they were supposed to do.

Re: Bad SSL

#8

Post by noja » Sat, Mar 18, 2017, 12:02 PM UTC

popey456963 wrote: post #3

Handgemenge wrote: post #2

https://www.sslshopper.com/ssl-checker.html comes to mind

I'm actually more of a fan of https://www.ssllabs.com/ssltest/analyze.html - it gives you a whole lot more information (although does take longer).

Both of those sites are for checking remote servers. BadSSL is for checking what your client browser behavior is.

Re: Bad SSL

#9

Post by [deleted] » Sat, Mar 18, 2017, 12:13 PM UTC

[deleted]

Re: Bad SSL

#10

Post by samat » Sat, Mar 18, 2017, 12:14 PM UTC

buhrmi wrote: post #4

this must be really useful when developing your own browser

For me main use case is to test browsers our employees use and to educate users on examples. Previously I've been using ssl quality labs test history to find some bad ssl examples, but this is much more convenient.