search

chromium / badssl.com

:lock: Memorable site for testing clients against bad SSL configs.
https://badssl.com
Apache License 2.0
2.83k stars 191 forks source link

subdomain tls-v1-2 reports false positive #436

Closed appills closed 4 years ago

appills commented 4 years ago

https://tls-v1-2.badssl.com:1012/ is currently down (connection timed out), and the dashboard reports that the result is NOT secure - I'm not sure what the result should be in this case (maybe some kind of UNKNOWN status). I've tried accessing the URL with Chrome and curl, both resulted in timeouts.

Browser information:

Chrome 80.0.3987.132 Windows 10.0

image

christhompson commented 4 years ago

I can't reproduce this. I'm not sure what would be causing it, but could you try testing on a different network to see if it still reproduces?

lgarron commented 4 years ago

In this case, the result at least fails safe – you won't think you were secure if you weren't.

But perhaps it might be worth adding a general disclaimer to https://badssl.com/dashboard/ ?

Like @christhompson, I don't know what would prevent you from accessing https://tls-v1-2.badssl.com:1012/, unless something on your computer/network is blocking the domain/port/protocol.

appills commented 4 years ago

Tried on a different network, it checks out now. I'll check with my ops team to see if they have anything in place that would block it. Thanks! I think this can be closed, but if @lgarron would like to open a new request for the disclaimer I encourage him to do so :)

djcater commented 4 years ago

Just to note that many corporate web proxies block access to ports other than common web ports such as 80 and 443, which could be why you're not able to access it.