Git/testssl.sh
1
0
Fork 0
mirror of https://github.com/drwetter/testssl.sh.git synced 2026-09-14 13:48:16 +02:00
Code Issues Packages Projects Releases Wiki Activity
5,421 Commits 16 Branches 39 Tags
a75e25a958adb192c5045c190b97f7b217b38bb9
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Dirk WetterandGitHub a75e25a958 Minor changes 2026-06-22 12:55:45 +02:00
Dirk WetterandGitHub 74ba0c4f1e Add links 2026-06-22 12:47:24 +02:00
Dirk WetterandGitHub efab5f9165 AI section + minor improvements 
- AI generated code becomes more important, so we add a new section (albeit bash support is not really as good as for other languages).
- streamlined comment, which is a comment
 2026-06-22 12:33:11 +02:00
Dirk WetterandGitHub a55fc6d5d4 Merge pull request #3071 from testssl/potato-20-revive-hsts-preload 
Potato 20 revive hsts preload
 2026-06-20 18:34:54 +02:00
Dirk Wetter bfdfaf49a6 Merge branch 'potato-20-revive-hsts-preload' of github.com:testssl/testssl.sh into potato-20-revive-hsts-preload 2026-06-20 17:19:38 +02:00
Dirk Wetter bb408fd7d5 reflect renaming the variable 
and u+x the script
 2026-06-20 17:17:36 +02:00
Dirk Wetter a13eb751ec Credit where credits is due 
Amend manyak
 2026-06-20 16:54:30 +02:00
Dirk Wetter 083f0148ca Move --phone-out to 3.3dev 2026-06-20 16:53:36 +02:00
Dirk Wetter fda8d34edd Minor changes to #3060 (HSTS preload) 
- readability: case statements!
- we query the API, not the list
- safe_echo makes echo safer
 2026-06-20 16:46:32 +02:00
Dirk Wetter 2b00b984f9 Merge branch 'revive-hsts-preload' of https://github.com/potato-20/testssl.sh into potato-20-revive-hsts-preload 2026-06-20 16:10:52 +02:00
Dirk WetterandGitHub 2a30ddc35e Merge pull request #3069 from testssl/dependabot/github_actions/actions/checkout-7 
Bump actions/checkout from 6 to 7
 2026-06-20 15:56:44 +02:00
Dirk WetterandGitHub 8d0f86eada Merge pull request #3066 from logopk/fix/issuer-cn-linecount 
[Bug] FIXME: issuer_CN error with more than 5 lines in Issuer #3065
 2026-06-18 11:29:47 +02:00
Dirk WetterandGitHub 53d0125b44 Merge pull request #3068 from testssl/dependabot/github_actions/actions/checkout-6 
Bump actions/checkout from 4 to 6
 2026-06-18 09:51:44 +02:00
Dirk WetterandGitHub 826449115c Merge pull request #3064 from testssl/automate_pandoc 
Automate pandoc
 2026-06-17 11:24:25 +02:00
Dirk Wetter 2dc81417f6 git push 2026-06-17 11:21:31 +02:00
Dirk Wetter 85f80a6487 change template name 2026-06-17 11:12:53 +02:00
Dirk Wetter 1297c88d26 fix syntax error 2026-06-17 11:08:24 +02:00
Dirk Wetter 8fd171783c Correct dir name, autopush gnerated files 2026-06-17 11:05:47 +02:00
Dirk Wetter 4f874b3ebf should better run on PR 2026-06-17 10:51:38 +02:00
Dirk Wetter 1d6045ccd8 Add workflow for pandoc 2026-06-17 10:43:05 +02:00
Dirk Wetter 0359a363ae Change title --> trigger pandoc 2026-06-17 10:41:49 +02:00
Dirk WetterandGitHub e0af44a7be Merge pull request #3058 from testssl/debug_hooks 
Provide better debugging means for GH runners
 2026-06-10 14:11:14 +02:00
Dirk 8e25163625 Remove QUIC from runner 2026-06-10 10:03:25 +02:00
Dirk 457f8fd0a0 Provide better debugging means 
This is just to assist debugging of the runners, so that
we can grab in a case needed the screen and stderr .

* there's a script t/03_debug.t.DISABLED which needs to be renamed then
* it utilises IPC::Run3
- also showing the PATH is added for both runners
- Readme amended accordingly
 2026-06-09 13:43:43 +02:00
Dirk WetterandGitHub c25a0ad491 Merge pull request #3057 from testssl/drwetter-patch-1 
Hide CI badges for now
 2026-06-09 10:39:41 +02:00
Dirk WetterandGitHub 2f591423f2 fix spelling 2026-06-09 10:39:03 +02:00
Dirk WetterandGitHub 5205310c0c Remove CI badges 
... as they reflect the PR status and not the current branch

See #2794
 2026-06-09 10:36:24 +02:00
Dirk WetterandGitHub e7204bd524 Merge pull request #3056 from testssl/revert-3055-drwetter-patch-1 
Revert "Trying to fix the badge issue"
 2026-06-09 10:32:16 +02:00
Dirk WetterandGitHub f634570af7 Revert "Trying to fix the badge issue" 2026-06-09 10:31:37 +02:00
Dirk WetterandGitHub fbedfe5f5f Merge pull request #3055 from testssl/drwetter-patch-1 
Trying to fix the badge issue
 2026-06-09 10:19:40 +02:00
Dirk WetterandGitHub 01f9b49549 Update unit_tests_ubuntu.yml 
... also for the ubuntu runner
 2026-06-09 10:18:52 +02:00
Dirk WetterandGitHub b9dda9312d Trying to fix the badge issue 
... by having the runner only act on 3.3dev. Sounds counter intuitive but I was recommended to try
 2026-06-09 10:16:50 +02:00
Dirk WetterandGitHub db014a6289 Merge pull request #3054 from testssl/drwetter-patch-1 
Fix badges, try 2
 2026-06-09 09:58:42 +02:00
Dirk WetterandGitHub ea16c81e97 Fix badges, try 2 
* comment in status badges (try)
* stars getting to work again
 2026-06-09 09:57:21 +02:00
Dirk WetterandGitHub fe080150cf Merge pull request #3053 from testssl/drwetter-patch-1 
Handle badges, remove 1 bracket
 2026-06-09 09:45:10 +02:00
Dirk WetterandGitHub 1bf15f41e1 Handle badges 2026-06-09 09:42:50 +02:00
Dirk WetterandGitHub cfde1df489 Merge pull request #3050 from potato-20/add-modern-security-headers 
Report additional modern security headers (INFO)
 2026-06-09 09:22:54 +02:00
Dirk WetterandGitHub 8f588813c0 Merge pull request #3049 from potato-20/fix-mx-host-port-2986 
Fix --mx host:port parsing and incorrect no-MX message (#2986)
 2026-06-08 18:33:32 +02:00
Dirk WetterandGitHub 654dc18760 Merge pull request #3052 from testssl/mac_runner_update 
Update runner to macos-26 (arm64 as before)
 2026-06-08 17:08:16 +02:00
Dirk Wetter 3c5b733431 Update runneer to macos-26 (arm64 as before) 
... as they were strange failures in the past.

Supported runners: https://docs.github.com/en/actions/reference/runners/github-hosted-runners#single-cpu-runners .
Details: https://github.com/actions/runner-images/blob/main/images/macos/macos-26-arm64-Readme.md
 2026-06-08 16:41:37 +02:00
Dirk WetterandGitHub 7f63e73ec3 Merge pull request #3046 from SteveVaneeckhout/fix-permissions-policy-duplicate 
Fix Permissions-Policy header listed twice in output
 2026-05-30 17:47:56 +02:00
Dirk WetterandGitHub 316b1a8014 Merge pull request #3045 from testssl/add_fs_data_clientsimulation_json 
Add fs data clientsimulation json
 2026-05-29 16:07:24 +02:00
Dirk 209e76541e Using a compariable Linux distro in the firstplace for updating handshake would have been great ;-) 2026-05-29 15:20:17 +02:00
Dirk ec99148700 Fix html output runner 2026-05-29 13:00:58 +02:00
Dirk 1ee1a60a99 var name append_fileout is clearer 2026-05-29 10:53:28 +02:00
Dirk 566e1b1f65 Fix diff complaint raised by ./t/12_diff_opensslversions.t 2026-05-29 10:33:03 +02:00
Dirk cff2c0810c Add Linux, not Mac baseline ;-) 2026-05-28 20:41:00 +02:00
Dirk Wetter 01d58f5e9c update client simulation data 2026-05-28 19:07:28 +02:00
Dirk Wetter cf66ad61bd Add forward secrecy data to file output 
This fixes #3040 .

Also this removes the debug lines within the if statement (bottom of run_client_simulation() ), probably
a historic leftover.
 2026-05-28 19:03:39 +02:00
Dirk WetterandGitHub 9567e65a01 Merge pull request #3043 from testssl/issue_cmdline_warnings 
Introduce early warning function
 2026-05-28 13:31:27 +02:00
Dirk Wetter 75376d38bf Introduce early warning function 
... which warns also via file output when not recommended command
line options are used.

This function named issue_cmdline_warnings() is being called in
lets roll after all fileout() functions has been initialized.
It needs to make use of fileout_insert_warning() though because
otherwise the JSON output is not correct.

Besides the previoulsy introduced warning when scanning IP addresses,
warnings of usage of '--fast' and '--ssl-native' will end up also
in a file now which gives ther tools using the machine readable
output to detect bad scan conditions.

Also warnings when scanning the most known IPv4 addresses
from Cloudflare, Google and Quad9, are avoided.
 2026-05-28 10:37:16 +02:00
Dirk WetterandGitHub ca99b45f1f Merge pull request #3042 from testssl/grhza-3.3dev 
Improve PR #3041
 2026-05-27 18:16:42 +02:00
Dirk Wetter f8af511952 Improve PR #3041 
* move message when scanning IP address to the very beginning, inside parse_cmd_line()
* improve message
* just check whether there are no chars a-zA-Z

* move [[ $caa_node =~ '.'$ ]] || caa_node+="." into the while loop
 2026-05-27 16:53:06 +02:00
Dirk WetterandGitHub 2f51cff728 Merge pull request #3039 from phpipam/3.3dev 
Added link to php-ssl Certificate scanning integration
 2026-05-19 17:27:07 +02:00
Dirk WetterandGitHub 84235d35c0 Merge pull request #3038 from testssl/more_handshakes_updates 
Client handshake updates
 2026-05-18 22:14:26 +02:00
Dirk 7871d800f9 adjust baseline runner output 2026-05-18 21:30:57 +02:00
Dirk 01b7ad7cc8 correct name 2026-05-18 21:30:34 +02:00
Dirk 56697cee48 Consolidate handshakes for all Safaris 26.4 
Looked before at ja3, but for Chromium-browsers ja4 is relevant.
The client column needed to be extended with 1 space.
 2026-05-18 21:16:43 +02:00
Dirk b4e58dfbb5 Consolidated Handshakes 
went through a couple of pcap files and determined ja3 + ja4 sums.

- Android 15/16 are the same (previously ja3 taken instead of ja4 and wrong host. One has to use chrome !)
- Edge 101/Chrome 101 are the same (will be deprated next time)
- surprisingly Java 17.0.3 and 21.0.6 were the same.

- Added: Ja3/ja4 for old Apple Mail and Thunderbird
 2026-05-18 18:45:04 +02:00
Dirk 7897cdcd84 Android 16 
As mentioned in the comment: For Androids ja3 is is not unique, probably because of GREASE.
One can add two handshakes after another and they are different. ja4 seems more consistent here.

This should be kept in mind for all clients "supplying some grease"
 2026-05-18 16:50:06 +02:00
Dirk 56e4a74485 Add OpenSSL 4.0 2026-05-17 15:23:42 +02:00
Dirk a35e9f816d Broaden table for client simulation 
... as some clients are the same and space wasn't enough.
 2026-05-16 16:14:24 +02:00
Dirk dd4c0b371d Handshakes for iOS + iPadOS 26.4. added 2026-05-16 16:04:13 +02:00
Dirk 7be3897437 Update MacOS/Safari 26.4 
it has PQC kx finally, whohoo
 2026-05-15 21:31:06 +02:00
Dirk 14e8df3fab Update readme wrt ja3/ja4 + imotr tweaks 2026-05-15 21:30:07 +02:00
Dirk 60131b4b5d - Update Apple Client Simulations 2026-05-15 21:28:54 +02:00
Dirk WetterandGitHub 0e59b983f1 Merge pull request #3030 from testssl/fix_unicode_3003 
Fix DN conversion when reading certificate issuer
 2026-04-22 15:34:21 +02:00
Dirk WetterandGitHub 146605e740 Merge pull request #3031 from testssl/fix_doc-problem_3029 
Fix doc error regarding MAX_SOCKET_FAIL + MAX_OSSL_FAIL
 2026-04-20 18:58:51 +02:00
Dirk b773fa9939 Fix doc error regarding MAX_SOCKET_FAIL + MAX_OSSL_FAIL 
The trailing error messages were swapped in the paragraphs /
description for MAX_SOCKET_FAIL + MAX_OSSL_FAIL .

This fixes the confusion for 3.3dev , see #3028 .
 2026-04-20 18:43:59 +02:00
Dirk b573a4f786 Fix DN conversion when reading certificate issuer 
This fixes #3003 .

The conversion to proper UTF-8 should have taken place by just using
`-nameopt RFC2253`, see manpage openssl-namedisplay-options(1ssl).

As @dcooper16 suggested removing esc_msb should help. This may look
counterintuitive but works.
 2026-04-20 18:09:36 +02:00
Dirk WetterandGitHub d2d684e31b Merge pull request #3029 from testssl/fix_fix_2809 
Address missing extended_master secret extension properly
 2026-04-20 17:49:24 +02:00
Dirk cff949bb90 Address missing extended_master secret extension properly 
This PR "fixes feature" #2809 which was formerly not properly implemented in #2982,
see comment https://github.com/testssl/testssl.sh/issues/2806#issuecomment-4164847538.

Now TLS 1.3.-only servers won't get penalized when the master secret extension
is missing.
 2026-04-20 16:31:44 +02:00
Dirk WetterandGitHub 7c47d8a8eb Merge pull request #3023 from dcooper16/identity_ossl_tls13_ciphers 
Identify TLS 1.3 ciphers by OpenSSL name
 2026-04-17 11:59:10 +02:00
Dirk WetterandGitHub 24eb5dec8a Merge pull request #3024 from dcooper16/missing_groups 
Add missing TLS 1.3 Brainpool groups
 2026-04-15 11:41:14 +02:00
Dirk WetterandGitHub 57cca5c2a0 Merge pull request #3020 from dcooper16/use_sigalgs 
Use OpenSSL with -sigalgs option to obtain server's certificate
 2026-04-13 09:36:47 +02:00
Dirk WetterandGitHub 93ae5d78f4 Merge pull request #3021 from dcooper16/missing_sigschemes 
Add missing TLS signature schemes
 2026-04-13 09:34:20 +02:00
Dirk WetterandGitHub e3ec72a359 Merge pull request #3018 from dcooper16/ossl4_ocsp 
OpenSSL 4 compatibility for stapled OCSP responses
 2026-04-12 13:24:01 +02:00
Dirk WetterandGitHub b14ed4def5 Merge pull request #3017 from dcooper16/tls_data 
Clean up etc/tls_data.txt
 2026-04-11 11:22:17 +02:00
Dirk WetterandGitHub 012a296184 Merge pull request #3015 from testssl/dcooper16-1 
Add draft-yang-tls-hybrid-sm2-mlkem
 2026-04-09 11:53:23 +02:00
Dirk WetterandGitHub e370aabb33 Update CREDITS.md 2026-04-09 11:52:50 +02:00
Dirk WetterandGitHub 48b29194b9 Add draft-yang-tls-hybrid-sm2-mlkem 2026-04-09 11:43:02 +02:00
Dirk WetterandGitHub adff28d50c Merge pull request #3014 from dcooper16/rfc8998 
Add support for RFC 8998 and draft-yang-tls-hybrid-sm2-mlkem
 2026-04-09 11:29:08 +02:00
Dirk WetterandGitHub 3f9eb84778 Merge pull request #3012 from testssl/fix_3009_date-detection 
Make sure date -r hits a dir readable
 2026-04-07 16:00:04 +02:00
Dirk Wetter ec95862790 Make sure date -r hits a dir readable 
When checking early for date flavors, there might be an edge case when
a directory with a referred file (for the date command) isn't readable
which might cause testssl.sh to not detect the date flavor correctly.

This fixes that by cd'ing to / in a subshell which should be cd'able
and readable under every platform.
 2026-04-07 10:27:46 +02:00
Dirk WetterandGitHub 802061f492 Merge pull request #3010 from testssl/patch-1 
Fix typo
 2026-04-07 09:48:37 +02:00
Dirk WetterandGitHub 693a7c1682 Fix typo 2026-04-07 09:47:36 +02:00
Dirk WetterandGitHub 5958f063f6 Merge pull request #3005 from dcooper16/ossl4 
OpenSSL 4 compatibility
 2026-03-25 09:49:42 +01:00
Dirk WetterandGitHub 9c086b2e15 Merge pull request #3002 from testssl/dependabot/github_actions/docker/build-push-action-7 
Bump docker/build-push-action from 6 to 7
 2026-03-12 11:02:37 +01:00
Dirk WetterandGitHub 3142e73b99 Merge pull request #3001 from testssl/dependabot/github_actions/docker/setup-buildx-action-4 
Bump docker/setup-buildx-action from 3 to 4
 2026-03-12 11:02:13 +01:00
Dirk WetterandGitHub a24990ef90 Merge pull request #3000 from testssl/dependabot/github_actions/docker/metadata-action-6 
Bump docker/metadata-action from 5 to 6
 2026-03-12 11:01:45 +01:00
Dirk WetterandGitHub 63a07e38e1 Merge pull request #2999 from testssl/dependabot/github_actions/docker/setup-qemu-action-4 
Bump docker/setup-qemu-action from 3 to 4
 2026-03-12 11:01:01 +01:00
Dirk WetterandGitHub a7f16fd189 Merge pull request #2998 from testssl/dependabot/github_actions/docker/login-action-4 
Bump docker/login-action from 3 to 4
 2026-03-12 11:00:30 +01:00
Dirk WetterandGitHub 87ecc1c9f2 Merge pull request #2997 from testssl/drwetter-patch-1 
don't use 3.0 docker images anymore
 2026-02-19 10:53:34 +01:00
Dirk WetterandGitHub 81fb5f967f don't use 3.0 anymore 2026-02-19 10:52:31 +01:00
Dirk WetterandGitHub 552e10ce8a Merge pull request #2995 from testssl/drwetter-patch-1 
Amend IPv6 with host networking
 2026-02-18 10:32:48 +01:00
Dirk WetterandGitHub 8aca6f0665 Amend IPv6 with host networking 2026-02-18 10:31:24 +01:00
Dirk WetterandGitHub aef8616e5b Merge pull request #2992 from testssl/back2thedev 
Change banner back to 3.3dev
 2026-02-18 10:25:29 +01:00
Dirk WetterandGitHub 4086cb593e Merge pull request #2994 from testssl/drwetter-patch-1 
Docker + IPv6
 2026-02-18 10:01:48 +01:00
Dirk WetterandGitHub 6cc8c857a8 Docker + IPv6 2026-02-18 10:00:57 +01:00
Dirk 094c61caea Change banner back to 3.3dev 2026-02-13 14:25:58 +01:00