4

Where can I find certificates signed by a CA which are invalid? I need them to test a program I'm writing - I want to check if it will correctly mark invalid certificates.

I found this site: https://badssl.com/ but I can't find any way to download the invalid site certificate.

I'm interested mainly in expired and revoked certificates. And (I'm not sure if it is important) I'm looking for certificates for signing things, not for web certificates (but AFAIK they're same).

|improve this question
  • 1
    You could generate a free let's encrypt certificate and then revoke it (letsencrypt.org/docs/revoking). – iainpb Mar 14 '18 at 14:56
  • 4
    Any reason to not generate them yourself? – Nico Mar 14 '18 at 15:31
  • 2
    If the things are email and/or code, the certs for signing those are usually different (in ExtdKeyUsage) than SSL/TLS servers (which includes webservers and many others) which are sometimes different than clients. If the things are other than those, it varies. – dave_thompson_085 Mar 15 '18 at 3:18
  • Please note that certificates can be invalid for many reasons, assuming you're talking about a certificate identifying a server on an SSL or TLS connection: the certificate has expired, is not yet valid, does not say it is intended to identify a server (2 ways I think), the CN or no DNSAlternativeName matches the server name (* matches all except .), the root of the chain is not marked as a CA certificate, the top of the chain points to a certificate your program doesn't know about, the cert is on some revocation list, etc etc. Moral: don't build this yourself: find a library you trust. – Marnix Klooster Mar 23 '18 at 5:24
5

BadSSL is open-source. You can find some of the certificates in their GitHub repository.

On Chrome, you can also export the certificate used for a tab.

  • Click on "Not Secure", then click on "invalid" under "Certificate".
  • See the details tab, then click "export" to save the certificate.
|improve this answer
  • Other ways to easily copy a server's cert: openssl s_client (with -servername if SNI is needed which nowadays it often is) or if you have Java (which may be a security issue in itself!) keytool -printcert -sslserver – dave_thompson_085 Mar 15 '18 at 3:20
0

You ca use openssl in order to generate untrusted self signed certificate.

openssl req -x509 -newkey rsa:4096 -keyout key.pem -out cert.pem -days 365
|improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.