How does your browser react to certificate errors?

Sometimes I need to see how my browser (or some other device) reacts to different certificate issues. Examples of issues are:

  • Expired certificate
  • Revoked certificate
  • Self-signed certificate
  • Certificates with wrong subject
  • Mixed content (http content on a https web page)

With the ongoing deprecation of SHA1, other interesting test cases are:

  • Certificate signed with SHA1 that expires in 2016
  • Certificate signed with SHA1 that expires in 2017

Instead of spending time on setting up these scenarios myself I use the following site:

https://badssl.com/

It works on any device that has a web browser. Here is a screenshot from Safari on my iPhone:

20151006_115352000_iOS

Clicking a button/link will redirect you to a website that has a certificate with that specific error.

Here are screenshots where the name of the site does not match the name in the certificate (the wrong.host button):

Edge

image

Internet Explorer 11

image

Chrome v45

image

For some reason they to not have a revoked certificate, so for testing that issue I use Steve Gibson’s test site at the address https://revoked.grc.com/

Advertisements
This entry was posted in Okategoriserade. Bookmark the permalink.

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s