Explicitly send the self-signed root for untrusted-root

chromium / badssl.com

:lock: Memorable site for testing clients against bad SSL configs.

https://badssl.com

Apache License 2.0

2.81k stars 190 forks source link

Explicitly send the self-signed root for untrusted-root #397

Closed sleevi closed 5 years ago

sleevi commented 5 years ago

Presently, the untrusted root test is indistinguishable from an incomplete certificate chain. As a consequence, client libraries may reject such a certificate as an incomplete chain, but would otherwise accept the chain if there was a leaf/end-entity certificate signed by a self-signed certificate.

Fixes https://github.com/chromium/badssl.com/issues/396