I'm looking for a way to have a negative test result on a site requiring HTTPS that has a http->https redirect. I already have steps showing the redirect, and I can use the --ssl-version-max=ssl3 flag in Chrome to make the request fail, but I'd rather not have to explain why SSLv3 is essentially like not having SSL at all.
-
Does this help? disablessl3.com – user246 Mar 24 '15 at 16:46
-
Not really. Appreciated, but that's more geared towards preventing POODLE attacks. I can already show that my webserver won't do anything lower than TLS1.0. I want to have objective evidence that HTTP won't work at all, but since the server redirects HTTP GET requests to HTTPS, I need a browser that won't do HTTPS at all. – Johnny_the_Boy Mar 24 '15 at 17:01
You could try using oldweb.today for example here is IE4 rejecting https://google.com since it is HTTPS.
