konklone / shaaaaaaaaaaaaa

Check if a website has weak SHA-1 TLS certificates.
https://shaaaaaaaaaaaaa.com
BSD 3-Clause "New" or "Revised" License
207 stars 27 forks source link

Example that fails test #81

Closed hickford closed 8 years ago

hickford commented 8 years ago

The readme shows https://isitchristmas.com as an example that fails the test, but as of October 2015 it passes the test (good news).

It would still be useful to give an example that fails. Perhaps there is a dedicated test site somewhere?

konklone commented 8 years ago

Indeed:

$ ./bin/shaaaaaaaaaaaaa sha1-2017.badssl.com
{
  "domain": "sha1-2017.badssl.com",
  "cert": {
    "algorithm": "sha1",
    "raw": "sha1WithRSAEncryption",
    "good": false,
    "root": false,
    "expires": "2017-01-05T12:00:00.000Z",
    "name": "*.badssl.com"
  },
  "intermediates": [
    {
      "algorithm": "sha1",
      "raw": "sha1WithRSAEncryption",
      "good": false,
      "root": false,
      "replacement": "http://cacerts.digicert.com/DigiCertSHA2SecureServerCA.crt",
      "expires": "2023-03-08T12:00:00.000Z",
      "name": "DigiCert Secure Server CA"
    }
  ],
  "diagnosis": "bad"
}

Updated the README to use this in 3f689dc. Thank you!

hickford commented 8 years ago

Thanks Eric this is very useful to me