testssl.sh

I use testssl.sh [1] mostly because I can test things not publicly accessible. [1] - https://github.com/testssl/testssl.sh

We also it at my work, where it's used both for mass scans of internal hosts, and scanning the same host many times during incidents/configuration changes. And the 20s is extra annoying because it's completely unnecessary. The tool is so slow because it's thousands of lines of pure bash, manipulating individual bytes. And because it's bash, it also breaks in confusing ways when you look at it wrong[1]. [1] https://github.com/testssl/testssl.sh/pull/2429

In a similar spirit there is also a site to scan security headers of any site [1] and another to verify the TLS settings from the Mozilla SSL Configuration Generator [2] and a git repo with code to scan sites from the command line [3] useful if the site is not reachable on the internet or automated scans to HTML reports. [1] - https://securityheaders.com/ [2] - https://www.ssllabs.com/ssltest/ [3] - https://github.com/testssl/testssl.sh

Seems like they support more than 3DES. It might be interesting if they shared stats on how many legit MTA's are using old ciphers. Should exclude bots, scanners, etc... There are of course other mitigating factors such as PGP encrypting emails, accepting that some information is still disclosed. That can be further mitigated by using gmail to only perform the initial communication then go out of band for anything sensitive. SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 offered (deprecated) TLS 1.1 offered (deprecated) TLS 1.2 offered (OK) TLS 1.3 offered (OK): final Testing cipher categories NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o A

Appears good for me, tested with testssl.sh [1]. Here is the fingerprint I see in the event you may have a MitM issue. openssl s_client -servername dash.cloudflare.com -connect dash.cloudflare.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin SHA1 Fingerprint=23:80:59:61:1E:82:7F:85:96:5F:06:38:D1:7F:C0:19:7C:D1:90:07 #sha256 openssl s_client -servername dash.cloudflare.com -connect dash.cloudflare.com:443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -sha256 -noout -in /dev/stdin sha256 Fingerprint=A8:F7:20:54:02:B2:61:0A:1C:1E:21:D7:64:79:A9:EA:05:7B:AE:BF:11:FD:78:C5:F9:68:BB:EB:F4:7F:69:6A Tested both IPv4 and IPv6, same results. [1] - https://github.com/drwetter/testssl.sh

As indigodaddy mentioned the cert is only signed for www and not the apex. [1]. The alternate name should be one or the other www vs apex. To run a test similar to Qualys one could clone testssl.sh [2] and run against a local development version of the site. requires bash and openssl Some headers may be missing [3]. Follow the links from Qualys and SecurityHeaders to get more information on how to remediate the findings. It might also not hurt to open a ticket with Cloudflare to see what else is going on here if you have a paid account. [1] - https://www.ssllabs.com/ssltest/analyze.html?d=www.teamkenne... [2] - https://github.com/drwetter/testssl.sh [3] - https://securityheaders.com/?q=https%3A%2F%2Fwww.teamkennedy...

For which domain? joinpeertube.org or one of the video hosting nodes? Use Qualys [1] to test the domain in question to link here or use the testssl.sh [2] code only depends on openssl and bash to test from your machine. If one of the many self hosted nodes, see if you can find a way to reach out to them and kindly suggest they set up certbot or a cron job to renew their certs. Joinpeertube.org looks good to me [3] so I assume you find a self-hosted node that needs some attention. If someone here knows of a way to query a list of all the self-hosted domains joined into peertube perhaps we could run testssl.sh against all of them to generate reports. I am not opposed to doing this if someone knows how I can get a list of all the domains using curl. [1] - https://www.ssllabs.com/ssltest/ [2] - https://github.com/drwetter/testssl.sh [3] -

Qualys does not appear to have an issue [1]. Testssh.sh [2] complains that they offer DES/IDEA and may also be vulnerable to CVE-2013-3587 but otherwise also gives them an A+. Have you tried multiple browsers and is your OS CA store up to date? [1] - https://www.ssllabs.com/ssltest/analyze.html?d=www.gov.uk [2] - https://github.com/drwetter/testssl.sh

It appears they have blocked or rate limited qualys for scanning them too much, but testssl [1] still works. I am not worried about being blocked since I just closed my account from 2001. The only serious warning I see is "Secure Client-Initiated Renegotiation VULNERABLE (NOT ok), DoS threat (6 attempts)" They otherwise get an "A+". Perhaps they have wan accelerators or anycast proxies with bad certs that are region specific? [1] - https://github.com/drwetter/testssl.sh [depends on bash and openssl]

If it's useful, here [1] is a tool for auditing the SSH config of a server from the internet and suggesting hardening options for both server and client. And here [2] is a tool for configuring TLS on various web servers, load balancers, mail servers and databases. One could also clone testssl.sh [3] to audit their TLS daemons on IP's not open to the internet. Depends on openssl and bash If hardening SSH it may be safest to first harden the SSH client and ensure one can still connect. Then harden the ssh daemon of a local machine using the same version of openssh used on ones servers to minimize the risk of locking one out of their own machine and having to use a rescue console or ILO. This may be counter-intuitive but going through the hardening process significantly speeds up SSH handshake time which may be most useful to those using

Qualys [1][2] For testing SSL of publicly accessible sites. TestSSL.sh [3] for testing SSL of any site including private endpoints you can reach from your machine Only requires openssl and bash. SecurityHeaders [4] for testing what headers are missing from a website. URLScan [5] for diagnosing a websites behavior. bgp.he.net [6] for looking up information about an IP/AS Number/domain. Robtex [7] also for looking up information about IP/AS/domain as well as org mapping. WhatIsMyDNS [8] for checking DNS propagation re-run this 3 times as their probe timeouts are way too low. Old-school VirusTotal [9] for old browsers for scanning malware. WhoisDS [10] targeting newly registered domains. Mozilla TLS configuration tool [11] for setting up proper TLS/HTTPS configuration on Nginx, Apache, HAproxy, etc... Certificate Search [12] for ce

If you like minimal dependencies another one to take a peek at may be acme.sh [1]. It depends on bash, openssl and curl. It seems to work fine in ash as well. It has code to handle most API's and most importantly to me is the great documentation. In the same spirit of minimal and light weight there is also testssh.sh [2] for testing TLS on HTTPS/SMTPS servers that also depends on bash and openssl. [1] - https://github.com/acmesh-official/acme.sh [2] - https://github.com/drwetter/testssl.sh

Out of curiosity, do you get any errors in Qualys [1] or TestSSL [2]? Use the checkbox to hide your domain from results on the Qualys site. Testssl is just bash+openssl that runs from your machine. [1] - https://www.ssllabs.com/ssltest/ [2] - https://github.com/drwetter/testssl.sh.git