Why is 'https://revoked.badssl.com/' and 'https://pinning-test.badssl.com/' returning 200 response using Python requests?

Question

I’m working with Python requests and testing URLs from https://badssl.com/ certificate section and all the invalid URLs are returning errors except for https://revoked.badssl.com/ and https://pinning-test.badssl.com/. They are responding with 200 status codes. I would like someone to explain why this is happening, despite the pages exhibiting errors such as NET::ERR_CERT_REVOKED and NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN for the former and latter respectively.

import requests
def check_connection():
    url='https://revoked.badssl.com/' or 'https://pinning-test.badssl.com/'
    try:
        r = requests.get(url)
        r.raise_for_status()
        print(r)
    except requests.exceptions.RequestException as err:
        print ("OOps: Something Else",err)
    except requests.exceptions.HTTPError as errh:
        print ("Http Error:",errh)
    except requests.exceptions.ConnectionError as errc:
        print ("Error Connecting:",errc)
    except requests.exceptions.Timeout as errt:
        print ("Timeout Error:",errt)

check_connection()

Asked By: CoderS

||

Source

Answer 1

You’re not getting an analog to "NET::ERR_CERT_REVOKED" message because requests is just an HTTP request tool; it’s not a browser. If you want to query an OCSP responder to see if a server certificate has been revoked, you can use the ocsp module to do that. There’s an example here.

The answer is going to be similar for "NET::ERR_SSL_PINNED_KEY_NOT_IN_CERT_CHAIN"; the requests module isn’t the sort of high-level tool that implements certificate pinning. In fact, even the development builds of major browsers don’t implement this; there’s some interesting discussion about this issue in https://github.com/chromium/badssl.com/issues/15.

Answered By: larsks

Why is 'https://revoked.badssl.com/' and 'https://pinning-test.badssl.com/' returning 200 response using Python requests?

Question:

Answers: