Test the rejection path as carefully as the happy path

TLS negotiation chooses parameters from the supported and permitted sets. A deployment must document its allowed protocol versions, algorithms, identity rules, and application protocols. A connection using a version permitted by that policy is not automatically evidence of a successful downgrade attack. Conversely, a client that retries over plaintext or deliberately disables verification after a failure can bypass the intended boundary regardless of a secure first attempt. Test that the failure is terminal where policy requires authenticated encrypted transport.

TLS 1.3 includes transcript and version-negotiation protections against specified active interference, but these mechanisms cannot make an application's explicitly insecure fallback safe. For a fictional service whose policy requires TLS 1.3, test successful allowed negotiation and rejection when only an excluded version is offered. Keep the test's premise separate from a universal recommendation for every deployment. Record the actual endpoint, negotiated version, cipher, ALPN, certificate identity, and whether resumption or early data changed the path being exercised.

Use otherwise comparable certificate fixtures to test an unknown issuer, a wrong exact service name, an expired or not-yet-valid certificate, and prohibited purpose or constraints. One failure can mask another: a wrong-name certificate under an unknown issuer cannot demonstrate that name checking runs, because the path may fail first. Add positive controls so an unreachable listener is not miscounted as successful security rejection. Test each termination leg and relevant client configuration, since a proxy can pass its checks while a direct origin or background worker bypasses them.

OpenSSL's s_client is a diagnostic tool that can continue after verification errors unless configured to return them. In a controlled local test, options such as -verify_return_error and -verify_hostname api.example.test express checks that merely setting -servername api.example.test does not. SNI chooses the virtual-host context; it is not the identity-verification instruction. Inspect the tool's documented behavior and exit outcome for the installed version, and test the real application's verification callback too. A successful diagnostic handshake with an error message is not evidence of correct production rejection.

For each case retain the expected outcome, actual failure stage, selected identity and trust configuration, and sanitized logs. Avoid recording private keys or reusable session secrets to make a convenient report. A regression should replay the relevant configuration and fixture so that a future permissive callback, forgotten minimum-version setting, or proxy exception is caught. When all declared cases pass, review whether the matrix omitted a materially different route, client type, trust store, resumption path, or fallback behavior. Passing an incomplete matrix cannot establish the missing boundary.

The sampling lab compares a deliberately synthetic independent-test model. Reset, set both p=0.02 and n=20, predict the exact zero-detection probability, then inspect and Play or Step. Reset again and set both p=0.02 and n=100 for a separate comparison. Playback highlights outcomes; it does not collect random tests. The exact zero bar falls from about 0.668 to 0.133. Ignore normal bars for this rare-event question and use the exact distribution. Real targeted security cases are not interchangeable independent draws, so the calculation motivates coverage scrutiny rather than certifying a system.