What it does
badssl.com provides labeled endpoints with certificate, protocol, mixed-content and related HTTPS conditions for examining client behavior.
Choose a labeled condition such as an expired certificate, wrong hostname or incomplete chain, then examine how the client handles it. badssl.com is a collection of test endpoints rather than a scanner for your own server. The repository says it is intended for manual security-UI testing and that subdomains can change without notice; the dashboard also marks several cases defunct. A controlled local copy is documented for repeatable development, with Docker, host mappings and test-certificate trust requirements. Keep the client version and chosen case with the observation. The published source is Apache-2.0 licensed and offered as-is.
Strengths
- Labeled certificate and protocol cases
- Grouped dashboard of test conditions
Watch out for
- Some listed cases are marked defunct
Sources
- badssl.com (Oct 26, 2026)
- badssl manual-test disclaimer and local prerequisites (Oct 26, 2026)