search

chromium / badssl.com

:lock: Memorable site for testing clients against bad SSL configs.
https://badssl.com
Apache License 2.0
2.85k stars 191 forks source link

A policy for when to create subdomains #152

Open lgarron opened 8 years ago

lgarron commented 8 years ago

Motivated by https://github.com/lgarron/badssl.com/issues/142#issuecomment-191421976

I've been sticking to an unofficial dichotomy of transport errors (certificate, protocol, key exchange, cipher suite) and content errors (mixed content).

Port shenanigans aside, we "need" individual subdomains for each combination of transport errors we want to test. I'd like to propose the following:

  1. Each combination of transport errors we care about gets a subdomain.
  2. Each content error gets a fixed path on each domain (under e.g. mixed or test), but not a subdomain.
  3. For convenience, each content error also gets one subdomain (with no transport errors).

I haven't gotten around to 3. yet, but I want to add a subdomain for each mixed content error, e.g. mixed-font.badssl.com.

april commented 8 years ago

I'm fine with the first two bullet points, but I would honestly rather disable mixed.badssl.com and the like when it comes to the third. It cleans up our configuration a good deal.

We can just change the link on the home page from: https://mixed-script.badssl.com to https://badssl.com/mixed/script/ and so on.