Support TLSv1 on DH (and other?) tests

[fishouttah20]

Most sites that enable DHE, do so to get Forward Secrecy on older clients that don't support ECDHE. By only negotiating TLSv1.2 and TLSv1.1 on the DH2048/1024/512 pages, none of the legacy systems/browsers can even connect to the page. Appreciate this may not be the primary use case for this project/site but it would be very useful to be able to confirm DH2048 support on things like OS X before 10.9, Chrome before 22, Firefox before 23 and lots and lots of mobile devices.

[lgarron]

It's totally a fair use case. After all, the site is called "bad ssl".
Some of the subdomains require certain TLS versions to support the proper features, but I've changed the default config, which is used by these domains.

Would you mind testing if that serves your need for those domains?
If so, I can try to put in the work to expand to more subdomains.

[fishouttah20]

A slight problem with the DH*.badssl.com domains. It looks like RSA-3DES snuck in on the TLS1/SSLv3 protocol configs so DH2048.badssl.com is visible on winXP with ie6 because it connects using a non-DHE cipher suite (and thus gives false positives). Other than that, this is exactly what I needed.

[fishouttah20]

Here is the output from sslyze for dh2048.badssl.com, it believes that only SSLv3 ciphers are non-DHE. ssllabs.com seemed to think it was connecting via tlsv1 and 3DES for IE8+XP, but as that is an simulation, I'm more inclined to test sslyze here.

• TLSV1_2 Cipher Suites:
  Preferred:
  DHE-RSA-AES128-GCM-SHA256 DH-2048 bits 128 bits HTTP 200 OK
  Accepted:
  DHE-RSA-AES256-SHA256 DH-2048 bits 256 bits HTTP 200 OK
  DHE-RSA-AES256-SHA DH-2048 bits 256 bits HTTP 200 OK
  DHE-RSA-AES256-GCM-SHA384 DH-2048 bits 256 bits HTTP 200 OK
  DHE-RSA-AES128-SHA256 DH-2048 bits 128 bits HTTP 200 OK
  DHE-RSA-AES128-SHA DH-2048 bits 128 bits HTTP 200 OK
  DHE-RSA-AES128-GCM-SHA256 DH-2048 bits 128 bits HTTP 200 OK
  • TLSV1_1 Cipher Suites:
    Preferred:
    DHE-RSA-AES128-SHA DH-2048 bits 128 bits HTTP 200 OK
    Accepted:
    DHE-RSA-AES256-SHA DH-2048 bits 256 bits HTTP 200 OK
    DHE-RSA-AES128-SHA DH-2048 bits 128 bits HTTP 200 OK
  • SSLV3 Cipher Suites:
    Preferred:
    ECDHE-RSA-AES128-SHA ECDH-256 bits 128 bits HTTP 200 OK
    Accepted:
    ECDHE-RSA-AES256-SHA ECDH-256 bits 256 bits HTTP 200 OK
    DHE-RSA-CAMELLIA256-SHA DH-1024 bits 256 bits HTTP 200 OK
    DHE-RSA-AES256-SHA DH-1024 bits 256 bits HTTP 200 OK
    CAMELLIA256-SHA - 256 bits HTTP 200 OK
    AES256-SHA - 256 bits HTTP 200 OK
    ECDHE-RSA-AES128-SHA ECDH-256 bits 128 bits HTTP 200 OK
    DHE-RSA-CAMELLIA128-SHA DH-1024 bits 128 bits HTTP 200 OK
    DHE-RSA-AES128-SHA DH-1024 bits 128 bits HTTP 200 OK
    CAMELLIA128-SHA - 128 bits HTTP 200 OK
    AES128-SHA - 128 bits HTTP 200 OK
    ECDHE-RSA-DES-CBC3-SHA ECDH-256 bits 112 bits HTTP 200 OK
    DES-CBC3-SHA - 112 bits HTTP 200 OK
  • TLSV1 Cipher Suites:
    Preferred:
    DHE-RSA-AES128-SHA DH-2048 bits 128 bits HTTP 200 OK
    Accepted:
    DHE-RSA-AES256-SHA DH-2048 bits 256 bits HTTP 200 OK
    DHE-RSA-AES128-SHA DH-2048 bits 128 bits HTTP 200 OK

[fishouttah20]

Closing this issue because the original ask was completed (but opening a new issue given the false positive problem)