Add neverssl.com to HTTPS upgrade exceptions

[mschfh]

No description provided.

[fmarier]

That website looks like it's misconfigured and not doing what it's supposed to:

$ curl --head https://neverssl.com
HTTP/1.1 200 OK
Date: Fri, 27 Sep 2024 19:40:01 GMT
Server: Apache/2.4.58 ()
Upgrade: h2,h2c
Connection: Upgrade
Last-Modified: Wed, 29 Jun 2022 00:23:33 GMT
ETag: "f79-5e28b29d38e93"
Accept-Ranges: bytes
Content-Length: 3961
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

$ curl --head https://neverssl.com
HTTP/1.1 200 OK
Date: Fri, 27 Sep 2024 19:40:13 GMT
Server: Apache/2.4.58 ()
Upgrade: h2,h2c
Connection: Upgrade
Last-Modified: Wed, 29 Jun 2022 00:23:33 GMT
ETag: "f79-5e28b29d38e93"
Accept-Ranges: bytes
Content-Length: 3961
Vary: Accept-Encoding
Content-Type: text/html; charset=UTF-8

It is actually listening on port 443 and in fact, it's telling the browser to upgrade the connection to HTTP2 which is TLS-only.

Does it still work in practice?

(I usually use http://http.badssl.com/.)