badssl.com is a testing resource that provides a collection of subdomains configured with intentionally bad SSL/TLS setups for validating how clients handle certificate errors and security issues.
The project solves the problem of testing browser and client behavior against misconfigured SSL certificates and protocols. It hosts multiple subdomains, each demonstrating a specific failure mode: self-signed certificates, expired certificates, mixed content, weak ciphers like RC4, and HSTS configurations. Rather than requiring developers to set up their own broken certificate infrastructure, badssl.com provides a stable, publicly accessible testing ground where security teams can verify that their clients properly reject or warn about problematic certificates.
The tool is designed for manual testing of security UI in web clients, making it suitable for browser developers, security researchers, and anyone building applications that need to validate SSL/TLS handling. It works best as a reference implementation for testing certificate validation logic rather than as an automated testing framework. The project explicitly disclaims being suitable for automated testing and notes that subdomains may change without notice, though most are expected to remain stable. For teams needing guaranteed stability, the README suggests forking and hosting a private copy.
Development on the project involves contributions from multiple organizations including Mozilla and Google Chrome, with external contributors implementing various subdomains and test pages. The infrastructure is hosted on Google Cloud and maintained across several maintainers with expertise in browser security. The project accepts community contributions and encourages filing issues for specific use cases or documentation needs.
