Submission timeline
2007–2026One slot for every year since HN launched. Height is that year's peak points; orange marks a 100+ point or 50+ comment breakout. Select a bar to open its strongest thread.
Top comments
An incredibly useful resource, well maintained by some of the best people in the PKI space, recently quoted by US-CERT [1] and so quick to use that I try it before starting to use any browser. A year ago it made me find out that the most popular iOS Tor browser doesn't check certificates at all. [2] (Use OnionBrowser instead.) [1] https://www.us-cert.gov/ncas/alerts/TA17-075A [2] https://twitter.com/FiloSottile/status/765230315132559360 For an easter egg, try to click on "Defunct"...
Ha. Their EV test (which they say you should be able to connect to, if your browser is "good") uses a certificate that expired Aug 10 2022: https://extended-validation.badssl.com
One thing they don't cover is name constraints; There's a bunch of ways that they can fail, and some surprising ways they don't - The default is permit all, so if you have a Web CA with name constraints, you should remember to add poison-pill constraints for e-mail addresses as well. It's of course not super easy for badssl to show such - They'd need an intermediate cert of their own, or close cooperation with a CA, but IRSG should…
Src code: https://github.com/lgarron/badssl.com Credit to moviuro for sharing @ https://news.ycombinator.com/item?id=10186516
The first top-level comment from each of the four biggest threads, in HN’s own order. Excerpts are shortened; open a comment for full context.
HN stats
- Breakout years
- 2
- Total points
- 613
- Total comments
- 127
100+ points or 50+ comments
reference only — not used in Hall rules or ranking
reference only — not used in Hall rules or ranking
Every submission
| Date | Title as submitted | By | Points | Comments |
|---|---|---|---|---|
| 2015-07-28 | Bad SSL | sajal83 | 3 | 0 |
| 2015-07-30 | Testing clients against bad SSL configs | jsanc | 2 | 0 |
| 2015-09-09 | Bad SSL | jaytaylor | 3 | 1 |
| 2015-12-01 | BadSSL: site for testing broken SSL | jgrahamc | 3 | 0 |
| 2016-06-08 | Does your code verify SSL certificates? | obi1kenobi | 2 | 0 |
| 2017-02-06 | Badssl.com | hiq | 2 | 0 |
| 2017-03-18 | Bad SSLFirst breakout · Best thread | aburan28 | 404 | 81 |
| 2019-12-09 | BadSSL – a tool for testing various errors with SSL/TLS server | djanowski | 3 | 0 |
| 2020-08-16 | Badssl.com | woldemariam | 1 | 0 |
| 2022-09-29 | Badssl.com (2017)Hall induction | aaronbrethorst | 150 | 34 |
| 2024-03-02 | Badssl.com (2017)Latest 20+ point return | g4zj | 40 | 11 |