Skip to content
This repository was archived by the owner on Jul 21, 2025. It is now read-only.

Commit a779188

Browse files
christhompsonchristhompson
authored
Add (known|blocked)-interception.badssl.com tests (#423)
1 parent a965c2a commit a779188

File tree

9 files changed

+150
-0
lines changed

9 files changed

+150
-0
lines changed

‎certs/Makefile‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -448,6 +448,34 @@ CHAINS_PROD += $(O)/gen/chain/subdomain-captive-portal.pem
448448
$(O)/gen/chain/subdomain-captive-portal.pem: $(O)/gen/crt/subdomain-captive-portal.crt $(O)/gen/crt/ca-intermediate.crt
449449
./tool chain $@ $(D) $^
450450

451+
################################
452+
$(O)/gen/key/leaf-blocked-interception.key:
453+
./tool gen-key $@ $(D) 2048
454+
455+
################################
456+
# Note: this is just a regular cert in `test`
457+
$(O)/gen/csr/subdomain-blocked-interception.csr: src/conf/subdomain-blocked-interception.conf $(O)/gen/key/leaf-blocked-interception.key
458+
./tool gen-csr $@ $(D) $^
459+
$(O)/gen/crt/subdomain-blocked-interception.crt: src/conf/subdomain-blocked-interception.conf $(O)/gen/csr/subdomain-blocked-interception.csr $(O)/gen/key/ca-intermediate.key $(O)/gen/crt/ca-intermediate.crt
460+
./tool sign $@ $(D) $(SIGN_LEAF_DEFAULTS) $^
461+
CHAINS_PROD += $(O)/gen/chain/subdomain-blocked-interception.pem
462+
$(O)/gen/chain/subdomain-blocked-interception.pem: $(O)/gen/crt/subdomain-blocked-interception.crt $(O)/gen/crt/ca-intermediate.crt
463+
./tool chain $@ $(D) $^
464+
465+
################################
466+
$(O)/gen/key/leaf-known-interception.key:
467+
./tool gen-key $@ $(D) 2048
468+
469+
################################
470+
# Note: this is just a regular cert in `test`
471+
$(O)/gen/csr/subdomain-known-interception.csr: src/conf/subdomain-known-interception.conf $(O)/gen/key/leaf-known-interception.key
472+
./tool gen-csr $@ $(D) $^
473+
$(O)/gen/crt/subdomain-known-interception.crt: src/conf/subdomain-known-interception.conf $(O)/gen/csr/subdomain-known-interception.csr $(O)/gen/key/ca-intermediate.key $(O)/gen/crt/ca-intermediate.crt
474+
./tool sign $@ $(D) $(SIGN_LEAF_DEFAULTS) $^
475+
CHAINS_PROD += $(O)/gen/chain/subdomain-known-interception.pem
476+
$(O)/gen/chain/subdomain-known-interception.pem: $(O)/gen/crt/subdomain-known-interception.crt $(O)/gen/crt/ca-intermediate.crt
477+
./tool chain $@ $(D) $^
478+
451479

452480
################################
453481
$(O)/gen/dhparam/dh480.pem:

‎certs/src/conf/subdomain-blocked-interception.conf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[ req ]
2+
default_bits = 2048
3+
distinguished_name = req_distinguished_name
4+
encrypt_key = no
5+
prompt = no
6+
req_extensions = req_v3_usr
7+
8+
[ req_distinguished_name ]
9+
countryName = US
10+
stateOrProvinceName = California
11+
localityName = San Francisco
12+
organizationName = BadSSL
13+
commonName = blocked-interception.__DOMAIN__
14+
15+
[ req_v3_usr ]
16+
basicConstraints = CA:FALSE
17+
subjectAltName = @alt_names
18+
19+
[ alt_names ]
20+
DNS.1 = blocked-interception.__DOMAIN__

‎certs/src/conf/subdomain-known-interception.conf‎

Lines changed: 20 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,20 @@
1+
[ req ]
2+
default_bits = 2048
3+
distinguished_name = req_distinguished_name
4+
encrypt_key = no
5+
prompt = no
6+
req_extensions = req_v3_usr
7+
8+
[ req_distinguished_name ]
9+
countryName = US
10+
stateOrProvinceName = California
11+
localityName = San Francisco
12+
organizationName = BadSSL
13+
commonName = known-interception.__DOMAIN__
14+
15+
[ req_v3_usr ]
16+
basicConstraints = CA:FALSE
17+
subjectAltName = @alt_names
18+
19+
[ alt_names ]
20+
DNS.1 = known-interception.__DOMAIN__

‎domains/cert/blocked-interception.conf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
---
3+
server {
4+
listen 80;
5+
server_name blocked-interception.{{ site.domain }};
6+
7+
return 301 https://$server_name$request_uri;
8+
}
9+
10+
server {
11+
listen 443;
12+
server_name blocked-interception.{{ site.domain }};
13+
14+
include {{ site.serving-path }}/nginx-includes/subdomain-blocked-interception.conf;
15+
include {{ site.serving-path }}/nginx-includes/tls-defaults.conf;
16+
include {{ site.serving-path }}/common/common.conf;
17+
18+
root {{ site.serving-path }}/domains/cert/blocked-interception;
19+
}

‎domains/cert/blocked-interception/index.html‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
subdomain: blocked-interception
3+
layout: page
4+
favicon: red
5+
background: red
6+
---
7+
8+
<div id="content">
9+
<h1 style="font-size: 10vw;">
10+
{{ page.subdomain }}.<br>{{ site.domain }}
11+
</h1>
12+
</div>
13+
14+
<div id="footer">
15+
The certificate for this site is associated with network interception.
16+
</div>

‎domains/cert/known-interception.conf‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
---
3+
server {
4+
listen 80;
5+
server_name known-interception.{{ site.domain }};
6+
7+
return 301 https://$server_name$request_uri;
8+
}
9+
10+
server {
11+
listen 443;
12+
server_name known-interception.{{ site.domain }};
13+
14+
include {{ site.serving-path }}/nginx-includes/subdomain-known-interception.conf;
15+
include {{ site.serving-path }}/nginx-includes/tls-defaults.conf;
16+
include {{ site.serving-path }}/common/common.conf;
17+
18+
root {{ site.serving-path }}/domains/cert/known-interception;
19+
}

‎domains/cert/known-interception/index.html‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
---
2+
subdomain: blocked-interception
3+
layout: page
4+
favicon: gray
5+
background: gray
6+
---
7+
8+
<div id="content">
9+
<h1 style="font-size: 10vw;">
10+
{{ page.subdomain }}.<br>{{ site.domain }}
11+
</h1>
12+
</div>
13+
14+
<div id="footer">
15+
The certificate for this site is associated with network interception.
16+
</div>

‎nginx-includes/subdomain-blocked-interception.conf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
---
3+
4+
ssl on;
5+
ssl_certificate {{ site.cert-path }}/subdomain-blocked-interception.pem;
6+
ssl_certificate_key /etc/keys/leaf-blocked-interception.key;

‎nginx-includes/subdomain-known-interception.conf‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
---
3+
4+
ssl on;
5+
ssl_certificate {{ site.cert-path }}/subdomain-known-interception.pem;
6+
ssl_certificate_key /etc/keys/leaf-known-interception.key;

0 commit comments

Comments
 (0)