UPDATE: Certificates are expired and many browsers have upped their DH requirements after the Logjam vuln. I have disabled the tests.

Some checks for browser capabilities regarding Diffie-Hellman key exchange. In the table below, images are included from various subdomains that use different Diffie-Hellman parameters. If you see an image the connection succeeded, if you see an X or some other error symbol from your browser the connection failed.

Tests requires Server Name Indication (SNI), all current browsers support that, some older ones don't. For the DSA tests you need to import the root cert from CAcert.org.

Results so far:

• Chrome/Chromium crashes on very short DH groups.
• Firefox rejects groups smaller 512 Bit.
• Konqueror and Safari accept all kinds of weird things including groups down to 8 bit and 15 as a "prime".
• Opera warns on groups smaller 1024 and proposes rejection (but gives dozends of popups, which is a bit annoying).
• IE only does DHE with a DSA 1024 bit certificate. CAcert.org still issues those certs. This is very bad practise, but it was good for my experiment.
• No browser checks if prime is really prime.

Some more background in my blog and I wrote a german article for Golem.de.

This test was created by Hanno Böck.