-2

There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/)

I want to build a collection of tests and demos for security headers and TLS configurations, something like https://badssl.com/

I want to build a running system to see everything in action, like badssl.com.How do I do it ?

closed as too broad by Stephane, WhiteWinterWolf, TildalWave, RoraΖ, Xander Jul 21 '15 at 11:12

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 4
    The question is unanswerably broad. – Deer Hunter Jul 20 '15 at 22:33
  • Any suggestions on how to start or how to do it ? @DeerHunter – wen_dy Jul 20 '15 at 22:48
4

Here's how I would do that:

  1. Examine all the test descriptions from sites like badssl and Qualys SSL Server Test.
  2. Follow up on links to the actual issues being tested, read and understand the problems.
  3. Run Qualys against your server, capture the traffic using tcpdump, and examine the interactions as much as possible to understand what's going on.
  4. Set up your own instance of badssl using the source code from github.

If you do all that, you'll get a pretty good understanding. It is, however, a bit of work.

Not the answer you're looking for? Browse other questions tagged or ask your own question.