title: How can you test that an SSL client library is properly verifying the certificate of the server to which it connects?
body: <p>I want to ensure that client libraries (currently in Python, Ruby, PHP, Java, and .NET) are configured correctly and failing appropriately when SSL certificates are invalid. Shmatikov's paper, <a href="http://www.cs.utexas.edu/~shmat/shmat_ccs12.pdf" rel="noreferrer">The Most Dangerous Code in the World:
  Validating SSL Certiﬁcates in Non-Browser Software</a>, reveals how confusing SSL validation is so I want to thoroughly test the possible failures.</p>
  
  <p>Based on research a certificate is invalid if:</p>
  
  <ul>
  <li>It is used before its activation date </li>
  <li>It is used after its expiry date </li>
  <li>It has been revoked</li>
  <li>Certificate hostnames don't match the site hostname </li>
  <li>Certificate chain does not contain a trusted certificate authority</li>
  </ul>
  
  <p>Ideally, I think I would have one test case for each of the invalid cases. To that end I am currently testing an <code>HTTP</code> site accessed over <code>HTTPS</code>, which leads to a failure that I can verify in a test like so:</p>
  
  <pre><code>self.assertRaises(SSLHandshakeError, lambda: api.call_to_unmatched_hostname())
  </code></pre>
  
  <p>This is incomplete (only covering one case) and potentially wrong, so... </p>
  
  <p><strong>How can you test that non-browser software properly validates SSL certificates?</strong></p>