More tests into trytls

[aleksiklasila]

List of the tests chosen to be added:

• https://sslv3.dshield.org:443 - poodle(sslv3)
• https://reverseheartbleed.com:443 - reverseheartbleed
• https://badcert-edell.tlsfun.de:443 - eDellRoot
• badtls.io tests

Instructions:

You can comment here the tests you would like to be considered to be added.
You can also comment here if you think a proposed test should/should not be added.
Feel free to comment new tests - no strings attached.

For example:

• https://sslv3.dshield.org:443 - poodle(sslv3)
• https://reverseheartbleed.com:443 - reverseheartbleed
• https://badcert-edell.tlsfun.de:443 - eDellRoot

[Mamietti]

We already have a version of Poodle from SSLLabs and one eDellRoot so we could once again use the "the more, the merrier" principle. The Reverse Heartbleed also seems like a legit issue after a quick read, especially due to TryTLS being a client-focused tester tool.

[aleksiklasila]

We have FREAK, LOGJAM and "goto fail"? from SSLLABS, no POODLE. If i am not mistaken. Or is poodle currently named as "protect against Apple's TLS vulnerability CVE-2014-1266"?

[Mamietti]

That's correct, no POODLE. ("Bad dog!")

[Mamietti]

Checking from here, we could try to find tests for the following

• validity starts after checking time
• not a CA/unknown Certificate Authority (CA)
• connection name and certificate do not match
• invalid wildcard in certificate

[Mamietti]

CVE-2009-2730, CVE-2006-4790 and CVE-2008-4989 from GnuTLS

[wbond]

You may be interested in some of the tests at https://github.com/wbond/badtls.io, although they do require that the library allow adding a custom CA.

[evilon]

Thanks @wbond! Initially looks very good and we will definitely take a closer look!

[jviide]

@wbond These are great, thank you! I created PR #157 for adding the tests (except for the auth ones) to the HTTPS bundle.

[jviide]

As a side note, the wbond/certbuilder and others in the modularcrypto package family might be a good match for generating our localhost test certs as well.

[Mamietti]

https://tlsfun.de in general could be one

[Mamietti]

#194 New tests for BadSSL have arrived