Example sites with broken security certs

Question

I'm wondering if there are any demo sites which show different cases where HTTPS is misconfigured or broken. Or does anyone know of websites in the wild that display various broken / misconfigured HTTPS cases? ... Perhaps ideas on how to track them down with a search engine? I'm looking for sites which exhibit broken https behaviors, for example:

• Self-signed certificate
• Certificatewith invalid subdomain
• Expired certificate
• Page with secure and un-secure content
• etc...

I'm looking to find a comprehensive list of the various ways that HTTPS can be misconfigured, and ideally perhaps live examples that I can use to hone a tool to crawl a page and tell you if it's going to produce any browser security errors. (As far as I know there is no such tool, short of a human operating a browser, anyone know of one?)

Answer 1

rt.cpan.org is an example of a self-signed certificate.

Answer 2

• https://mail.yahoo.com evidently is an example of a certificate with an invalid sub-domain. (Certificate for www.yahoo.com)
• https://verisign.com is another (Certificate for www.verisign.com)

Answer 3

https://pause.perl.org/

Answer 4

These may change but they currently reflect various certificate problems:

Intermediate certificate not installed: http://www.sslshopper.com/ssl-checker.html?hostname=secure.donauversicherung.at

Exact hostname not in certificate: http://www.sslshopper.com/ssl-checker.html?hostname=1stsource.com

Expired certificate: http://www.sslshopper.com/ssl-checker.html?hostname=secure.garthbrooks.com

Self-signed certificate: http://www.sslshopper.com/ssl-checker.html?hostname=www.mjvmobile.com.br

Certificate with an MD5 signature: http://www.sslshopper.com/ssl-checker.html?hostname=www.mtsindia.in

Answer 5

For those interested to know more about ssl under the covers, this page is very well worth a read http://www.moserware.com/2009/06/first-few-milliseconds-of-https.html