From 04f7b34028d183d698bbf95f1c026a3bd72ec8e0 Mon Sep 17 00:00:00 2001 From: mum-viadee Date: Fri, 12 May 2023 13:53:54 +0200 Subject: [PATCH] Added SNI to openssl call for testing secure renegotiation --- testssl.sh | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/testssl.sh b/testssl.sh index 66c8a3c..1b8e45d 100755 --- a/testssl.sh +++ b/testssl.sh @@ -16896,7 +16896,7 @@ run_renego() { local hint="" local jsonID="" local ssl_reneg_attempts=$SSL_RENEG_ATTEMPTS - # No SNI needed here as there won't be two different SSL stacks for one IP + # SNI is needed here as openssl return an error if missing "$HAS_TLS13" && [[ -z "$proto" ]] && proto="-no_tls1_3" @@ -16913,7 +16913,7 @@ run_renego() { fileout "$jsonID" "OK" "TLS 1.3 only server" "$cve" "$cwe" else # first fingerprint for the Line "Secure Renegotiation IS NOT" or "Secure Renegotiation IS " - $OPENSSL s_client $(s_client_options "$proto $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY") 2>&1 $TMPFILE 2>$ERRFILE + $OPENSSL s_client $(s_client_options "$proto $STARTTLS $BUGS -connect $NODEIP:$PORT $PROXY $SNI") 2>&1 $TMPFILE 2>$ERRFILE if sclient_connect_successful $? $TMPFILE; then grep -iaq "Secure Renegotiation IS NOT" $TMPFILE sec_renego=$? # 0= Secure Renegotiation IS NOT supported