There are (or have been) various websites designed to educate and provide examples on good / bad configurations of security headers and TLS configurations (e.g. https://badssl.com/)

I want to build a collection of tests and demos for security headers and TLS configurations, something like https://badssl.com/

I want to build a running system to see everything in action, like badssl.com.How do I do it ?

  • 4
    The question is unanswerably broad. – Deer Hunter Jul 20 '15 at 22:33
  • Any suggestions on how to start or how to do it ? @DeerHunter – wen_dy Jul 20 '15 at 22:48

Here's how I would do that:

  1. Examine all the test descriptions from sites like badssl and Qualys SSL Server Test.
  2. Follow up on links to the actual issues being tested, read and understand the problems.
  3. Run Qualys against your server, capture the traffic using tcpdump, and examine the interactions as much as possible to understand what's going on.
  4. Set up your own instance of badssl using the source code from github.

If you do all that, you'll get a pretty good understanding. It is, however, a bit of work.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.