badssl.com
badssl.com copied to clipboard
chromium
sslv3.badssl.com
This requires a separate IP address that doesn't use SNI (or at least defaults to SSLv3 with this particular domain).
Was this ever created? I was just looking for services out there that offer SSLv2 and SSLv3, then thought to myself "hey, wait a second, badssl.com FTW", but then couldn't find a subdomain here.
Yes, but we still don't have a separate IP, so it has to be on a separate port: https://ssl-v3.badssl.com:1003/
Hmm, I'm getting a connection reset when connecting to port 1003 on ssl-v3.badssl.com:
$ openssl s_client -ssl3 -connect ssl-v3.badssl.com:1003 CONNECTED(00000003) write:errno=54
Is that expected?
Is that expected?
I honestly don't know. Maybe OpenSSL has SSLv3 disabled by default, or something.
@davidben, do you know the magic incantation?
It looks like a problem with the server, not the OpenSSL incant. If it were an SSLv3 host, you would not expect ERR_CONNECTION_RESET in Chrome. Minimum versions are enforced by the client, not the server. Are you sure ssl-v3.badssl.com:1003 is set up correctly?
Definitely seems to be server-side. My instance of testssl.sh is using static SSLv3-enabled OpenSSL, and I'm able to successfully detect SSLv2 and SSLv3 on public servers known to be using those, but against ssl-v3, I get "104.154.89.105:1003 doesn't seem to be a TLS/SSL enabled server".
Good question - OK, if it's the same port (1003), I get the same result.
OK, if it's the same port (1003)
Uh, that sounds disconcerting. Each TLS protocol case has its own port:
https://ssl-v2.badssl.com:1002 https://ssl-v3.badssl.com:1003 https://tls-v1-0.badssl.com:1010 https://tls-v1-1.badssl.com:1011
If port 1003 is responding over SSLv2, that definitely sounds wrong.
Apologies - I was both unclear and also didn't realize the port mapping.
To clarify, ssl-v3:1003 is not responding for SSL/TLS at all. When I tried ssl-v2:1003, that also failed (which is now unsurprising).
I have just checked, and ssl-v2:1002 is also not responding.
Steps to recreate:
- Download testssl.sh and the appropriate accompanying signed static binary of openssl for your platform.
- Run testssl.sh against that openssl. On my platform, for example:
./testssl.sh --openssl=bin/openssl.Linux.x86_64 ssl-v2.badssl.com:1002
The response I get is:
104.154.89.105:1002 doesn't seem to be a TLS/SSL enabled server
No test that I've been able to perform remotely detects SSL/TLS on either port.
ssl-v2.badssl.com and ssl-v3.badssl.com (wether port 443, 1002 or 1003) do not respond with a cipher. I guess this is due to the limitation of modern openssl. If necessary, I can assist with building a proper openssl.
Why aren't SSL v2/v3 endpoints listed on the website?
They don't work with our installation of nginx.
Why aren't SSL v2/v3 endpoints listed on the website?
They don't work with our installation of nginx.
Well, this website, https://mailserv.baehal.com supports SSLv3 only. It was the only one I could find. Here is the SSL Labs test for this website. https://www.ssllabs.com/ssltest/analyze.html?d=mailserv.baehal.com Although, unfortunately, I was unable to find an SSLv2 only website.
