search

chromium / badssl.com

:lock: Memorable site for testing clients against bad SSL configs.
https://badssl.com
Apache License 2.0
2.81k stars 190 forks source link

1000-sans cert expired on Feb 17 2019 #383

Closed robrich closed 4 years ago

robrich commented 5 years ago

Because this certificate is expired, it's actually testing the expired cert case rather than the 1,000 sans case.

mimi89999 commented 5 years ago

Any news on this? Will this certificate ever get renewed?

april commented 5 years ago

I haven’t found a good way to get them renewed. Thankfully, they’re mostly for UI tests and so are fine with verification turned off.

If someone can get a CA to help, that would be amazing.

robrich commented 5 years ago

Are CAs balking because they don't like building certs with specifically bad details? Or is this a cost issue in buying this many certs?

dangeredwolf commented 5 years ago

They still haven't updated this.

april commented 5 years ago

Yes, it’s a cost issue. It would be tens of thousands of dollars without support from a CA. Since it’s mostly used for seeing how UX’s break, it shouldn’t be a big deal that it’s expired, as you can always manually trust it.

robrich commented 5 years ago

@april can we leverage Let's Encrypt for this? A quick node script we run once-a-month that pulls all the certs and saves them into a static site could work. I could help with a bit of research on their limits (1,000 SANs, revoking, etc)

april commented 5 years ago

Let’s Encrypt limits you to 100 domains per certificate unfortunately.

christhompson commented 4 years ago

This is now deployed. We were able to get a new 1000-sans cert from DigiCert.