Thanks for reposting this. We recently took this over from Kenneth Reitz and I'd love to hear your suggestions for improvements or additions.
Anyway, sounds really cool :)
https://expired.x509.httpbin.org/ - returns an otherwise valid cert that has expired
https://wrongcn.x509.httpbin.org/ - returns an otherwise valid cert with a different CN name
https://sslv3.tls.httpbin.org/ - only negotiates an SSLv3 connection
https//3des.tls.httpbin.org/ - only negotiates to use 3DES as the cipher
The response would then include "method": "BLAH" k/v indicating the method that was used.