cipherscan

Hm, looks like maybe a ticket should be filed against: https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deploym... As it stands, the point on resumption reads a little on the positive side?: > 3.2 Use Session Resumption > Session resumption is a performance-optimization technique that makes it possible to save the results of costly cryptographic operations and to reuse them for a period of time. A disabled or nonfunctional session resumption mechanism may introduce a significant performance penalty. Does http2 have similar issues with session resumption (especially: compromised pfs)? I came across this, which documents how cloudscape does this securely - at least they rotate - but looks like read access to memcache+compromise of a single web server is enough to compromise the past hour or two of ssl traffic that goes through cloudflar

I find Julien Vehent's CipherScan to be very useful https://github.com/jvehent/cipherscan

Author of Server Side TLS here. Almost everyone should be able to use the intermediate configuration we propose. I recommend our conf generator at https://mozilla.github.io/server-side-tls/ssl-config-generat... . Cipherscan is also a good tool to have in your toolbox: https://github.com/jvehent/cipherscan

Yet Another Test Script: https://github.com/jvehent/cipherscan It uses openssl to find out the cipher priorities, PFS keys and a few others things from a target site. I wrote it because, while I love SSLLabs and Ivan's work in general, I find it too slow to scan a setup I'm working on many times. And I like doing stuff in the terminal.