1d4622ebab
One server I am testing responds to an SSLv3 ClientHello with TLSv1.2. If tls_sockets is being used, then testssl.sh responds with "#FIXME: downgraded. still missing a test case here." This PR fixes that, and in general checks the responses in run_protocols() more closely. If tls_sockets is being used and the connection fails even though the server supports an earlier version of SSL/TLS, then it flags an error. If tls_sockets returns 2, then it verifies that $DETECTED_TLS_VERSION is equal to the highest version number supported by the server (that is also less than the version number in the ClientHello). In addition, in order to test servers' support for version negotiation, it adds a new test that sends a TLSv1.4 ClientHello and verifies that the server responds with the highest version number that it supports. (This test only runs if both $using_sockets and $EXPERIMENTAL are true and server actually supports some version of SSL/TLS other than SSLv2.) |
||
---|---|---|
bin | ||
etc | ||
utils | ||
CHANGELOG.stable-releases.txt | ||
CREDITS.md | ||
LICENSE | ||
openssl-rfc.mappping.html | ||
Readme.md | ||
testssl.sh |
Intro
testssl.sh
is a free command line tool which checks a server's service on
any port for the support of TLS/SSL ciphers, protocols as well as some
cryptographic flaws.
Key features
- Clear output: you can tell easily whether anything is good or bad
- Ease of installation: It works for Linux, Darwin, FreeBSD and MSYS2/Cygwin out of the box: no need to install or configure something, no gems, CPAN, pip or the like.
- Flexibility: You can test any SSL/TLS enabled and STARTTLS service, not only webservers at port 443
- Toolbox: Several command line options help you to run YOUR test and configure YOUR output
- Reliability: features are tested thoroughly
- Verbosity: If a particular check cannot be performed because of a missing capability on your client side, you'll get a warning
- Privacy: It's only you who sees the result, not a third party
- Freedom: It's 100% open source. You can look at the code, see what's going on and you can change it.
- Heck, even the development is open (github)
General
Here in the master branch you find the development version of the software -- with new features and maybe some bugs. For the stable version and a more thorough description of the command line options please see testssl.sh.
testssl.sh is working on every Linux/BSD distribution out of the box with
some limitations of disabled features from the openssl client -- some
workarounds are done with bash-socket-based checks. It also works on other
unixoid system out of the box, supposed they have /bin/bash
and standard
tools like sed and awk installed. MacOS X and Windows (using MSYS2 or
cygwin) work too. OpenSSL version >= 1 is a must. OpenSSL version >= 1.0.2
is needed for better LOGJAM checks and to display bit strengths for key
exchanges.
Current Development
Planned features in the release 2.7dev/2.8 are:
https://github.com/drwetter/testssl.sh/milestones/2.7dev%20%282.8%29
Done so far:
- Trust chain check against certificate stores from Apple (OS), Linux (OS), Microsoft (OS), Mozilla (Firefox Browser), works for openssl >=1.0.1
- IPv6 (status: 80% working, details see https://github.com/drwetter/testssl.sh/issues/11
- works on servers requiring a x509 certificate for authentication
- SSL Session ID check
- avahi/mDNS based name resolution
- HTTP2/ALPN protocol check
- Logging to a file / dir
- Logging to JSON + CSV
- check for multiple server certificates
- browser cipher simulation
- assistance for color-blind users
- Even more compatibility improvements for FreeBSD, RH-ish and F5 systems
- Considerable speed improvements for each cipher runs (-e/-E)
- OpenSSL 1.1.0 compliant
Update notification here or @ twitter.
Contributions
Contributions, feedback, bug reports are welcome! For contributions please note: One patch per feature -- bug fix/improvement. Please test your changes thouroughly as reliability is important for this project.
There's coding guideline.
Please file bug reports @ https://github.com/drwetter/testssl.sh/issues.
Documentation
For a start see the wiki. Help is needed here.
Bug reports
Please file bugs in the issue tracker. Do not forget to provide detailed information, see https://github.com/drwetter/testssl.sh/wiki/Findings-and-HowTo-Fix-them#file-a-proper-bug-report Nobody can read your thoughts -- yet.
External/related projects
Please address questions not specifically to the code of testssl.sh to the respective projects