Updated to version 3.0rcX

Reflect we're at 3.0rcX, 2.9.5 is past, 2.8 not supported

Removed features from 2.9.5. Added all(?-->David?) features implemented
in 2.9dev.

Mention docker image

Clarify when testssl.sh should be mentioned (license).

Readme.md

@@ -11,26 +11,25 @@ cryptographic flaws.
 #### Key features
 
 * Clear output: you can tell easily whether anything is good or bad
-* Ease of installation: It works for Linux, OSX/Darwin, FreeBSD, NetBSD,
+* Machine readable output
-  OpenBSD (needs bash) and MSYS2/Cygwin out of the box: no need to install
+* Ease of installation: Linux, OSX/Darwin, FreeBSD, NetBSD, MSYS2/Cygwin,
-  or to configure something.  No gems, CPAN, pip or the like/
+  WSL work out of the box (OpenBSD needs bash). No need to install
+  or to configure something.  No gems, CPAN, pip or the like
 * Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not
-  only webservers at port 443
+  only web servers at port 443
 * Toolbox: Several command line options help you to run YOUR test and
   configure YOUR output
 * Reliability: features are tested thoroughly
-* Verbosity: If a particular check cannot be performed because of a missing
-  capability on your client side, you'll get a warning
 * Privacy: It's only you who sees the result, not a third party
 * Freedom: It's 100% open source. You can look at the code, see what's
-  going on and you can change it.
+  going on
-* Heck, even the development is open (github)
+* The development is open (github) and participation is welcome.
 
 #### License
 
 This software is free. You can use it under the terms of GPLv2, see LICENSE.
-In addition starting from version 3.0rc1 if you're offering it as a public
+In addition starting from version 3.0rc1 if you're offering a scanner based on testssl.sh
-and / or paid service you need to mention to your audience that you're using
+as a public and / or paid service in the internet you need to mention to your audience that you're using
 this program and where to get this program from.
 
 #### Installation
@@ -44,25 +43,27 @@ https://github.com/drwetter/testssl.sh/archive/2.9dev.zip.  ``testssl.sh --help`
 will give you some help upfront.  More help: see doc directory with
 man pages. Older sample runs are at https://testssl.sh/.
 
+#### Running a docker container from dockerhub
+
+     docker run -ti drwetter/testssl.sh <your_cmd_line>
 
 #### Status
 
-Here in the _2.9dev branch you find the development version_ of the software
+In the 2.9dev branch we're developing the 3.0 release. We're currently in the
--- with new features and maybe some bugs -- albeit we try our best before
+release candidate phase. That means you can and should use it for production
-committing to test changes. Be aware that we also change the output or command
+and let us know if you encounter any additional bugs.
-line.
 
-For the previous stable version please see [testssl.sh](https://testssl.sh/
+For the previous stable version please see release
-"Go to the site with the stable version") or
+[2.9.5](https://github.com/drwetter/testssl.sh/tree/2.9.5) which is is the
-download  the interim release 2.9.5 from here [2.9.5](https://github.com/drwetter/testssl.sh/tree/2.9.5) which is is the
+successor of 2.8 and stable for day-to-day work. Support for 2.9.5 will be 
-successor of 2.8 and stable for day-to-day work.
+soon dropped. 2.8 is not supported anymore.
 
 #### Compatibility
 
 testssl.sh is working on every Linux/BSD distribution out of the box. Since 2.9dev
 most of the limitations of disabled features from the openssl client are gone
-due to bash-socket-based checks. As a result you can also use e.g. LibreSSL.
+due to bash-socket-based checks. As a result you can also use e.g. LibreSSL or OpenSSL
-testssl.sh also works on other unixoid system out of the box, supposed they have
+1.1.1. testssl.sh also works on other unixoid system out of the box, supposed they have
 `/bin/bash` >= version 3.2 and standard tools like sed and awk installed.
 System V needs to have GNU grep installed. MacOS X and Windows (using MSYS2 or
 cygwin) work too. OpenSSL version  version >= 1.0.2 is recommended for better
@@ -70,68 +71,59 @@ LOGJAM checks and to display bit strengths for key exchanges.
 
 Update notification here or @ [twitter](https://twitter.com/drwetter).
 
-#### Features implemented in [2.9dev](Readme.md#devel)
+#### Features implemented in [2.9dev](Readme.md#devel) (as opposed to [2.9.5](https://github.com/drwetter/testssl.sh/blob/2.9.5/Readme.md#features-implemented-in-295))
-* Using bash sockets where ever possible --> better detection of ciphers, independent on the openssl version used.
+* Full support of TLS 1.3, shows also drafts supported
-* Testing 364 default ciphers (``testssl.sh -e/-E``) with a mixture of sockets and openssl. Same speed as with openssl only but additional ciphers such as post-quantum ciphers, new CHAHA20/POLY1305, CamelliaGCM etc.
+* ROBOT check
-* Further tests via TLS sockets and improvements (handshake parsing, completeness, robustness),
+* Better TLS extension support
-* TLS 1.2 protocol check via socket in production
+* Better OpenSSL 1.1.1 support
-* Finding more TLS extensions via sockets
+* DNS over Proxy and other proxy improvements
-* TLS Supported Groups Registry (RFC 7919), key shares extension
-* Non-flat JSON support
-* File output (CSV, JSON flat, JSON non-flat) supports a minimum severity level (only above supplied level there will be output)
-* Support of supplying timeout value for ``openssl connect`` -- useful for batch/mass scanning
-* Parallel mass testing (!)
-* File input for serial or parallel mass testing can be also in nmap grep(p)able (-oG) format
-* Native HTML support instead going through 'aha'
-* Better formatting of output (indentation)
-* Choice showing the RFC naming scheme only
-* LUCKY13 and SWEET32 checks
-* Check for vulnerability to Bleichenbacher attacks
-* Ticketbleed check
 * Decoding of unencrypted BIG IP cookies
-* LOGJAM: now checking also for known DH parameters
+* Better JSON output: renamed IDs and findings shorter/better parsable
-* Check for CAA RR
+* JSON output now valid also for non-responding servers
-* Check for OCSP must staple
+* Testing now per default 370 ciphers
-* Check for Certificate Transparency
+* Further improving the robustness of TLS sockets (sending and parsing)
-* Expect-CT Header Detection
+* Support of supplying timeout value for ``openssl connect`` -- useful for batch/mass scanning
+* File input for serial or parallel mass testing can be also in nmap grep(p)able (-oG) format
+* LOGJAM: now checking also for DH  and FFDHE groups (TLS 1.2)
+* PFS: Display of elliptical curves supported, DH and FFDHE groups (TLS 1.2 + TLS 1.3)
 * Check for session resumption (Ticket, ID)
 * TLS Robustness check (GREASE)
-* Postgres und MySQL STARTTLS support, MongoDB support
+* Expect-CT Header Detection
-* Decodes BIG IP F5 Cookie
+* --phone-out does certificate revocation checks via OCSP (LDAP+HTTP) and with CRL
 * Fully OpenBSD and LibreSSL support
 * Missing SAN warning
-* Man page
-* Better error msg suppression (not fully installed OpenSSL)
-* DNS over Proxy and other proxy improvements
-* Better JSON output: renamed IDs and findings shorter/better parsable
-* JSON output now valid also for non-responsing servers
 * Added support for private CAs
-* Exit code now 0 for running without error
+* Man page reviewed
-* ROBOT check
+* Better error msg suppression (not fully installed OpenSSL)
-* Better extension support
+* Way better handling of connectivity problems
-* Better OpenSSL 1.1.1 support
+* Exit codes better: 0 for running without error, 1+n for small errors, >240 for major errors.
-* Supports latest and greatest version of TLS 1.3, shows drafts supported
+* Dockerfile and repo @ docker hub with that file (see above)
+* Java Root CA store added
+* Better support for XMPP via STARTTLS & faster
+* Certificate check for to-name in stream of XMPP
+* Support for NNTP via STARTTLS
+* More robustness for any STARTTLS protocol (fall back to plaintext while in TLS)
+* Fixed TCP fragmentation
+* Added `--ids-friendly` switch
 
-#### Further features planned in 2.9dev
+[Planned for 3.0](https://github.com/drwetter/testssl.sh/milestone/4).
+
+
+#### Documentation
+
+* There's a man page in groff, html and markdown format in `~/doc/`.
+* https://testssl.sh/ will help to get you started.
+* Will Hunt provides a longer, good [description](https://www.4armed.com/blog/doing-your-own-ssl-tls-testing/) for the version 2.8, including useful background info.
 
-https://github.com/drwetter/testssl.sh/issues?q=is%3Aopen+is%3Aissue+milestone%3A2.9dev
 
 #### Contributions
 
 Contributions, feedback,  bug reports are welcome! For contributions please
 note: One patch per feature -- bug fix/improvement. Please test your
-changes thouroughly as reliability is important for this project.
+changes thoroughly as reliability is important for this project.
 
 There's a [coding guideline](https://github.com/drwetter/testssl.sh/wiki/Coding-Style).
 
-Please file bug reports @ https://github.com/drwetter/testssl.sh/issues.
-
-#### Documentation
-
-For a start see the
-[wiki](https://github.com/drwetter/testssl.sh/wiki/Man-Page).
-Help is needed here. Will Hunt provides a good [description](https://www.4armed.com/blog/doing-your-own-ssl-tls-testing/) for version 2.8, including useful background info.
-
 #### Bug reports
 
 Please file bugs in the issue tracker. Do not forget to provide detailed information,
@@ -151,7 +143,7 @@ respective projects
 #### Mass scanner w parallel scans and elastic searching the results
 * https://github.com/TKCERT/testssl.sh-masscan
 
-#### A ready-to-go docker image is at:
+#### Another ready-to-go docker image is at:
 * https://quay.io/repository/jumanjiman/testssl
 
 #### Privacy checker using testssl.sh