testssl.sh

We also it at my work, where it's used both for mass scans of internal hosts, and scanning the same host many times during incidents/configuration changes. And the 20s is extra annoying because it's completely unnecessary. The tool is so slow because it's thousands of lines of pure bash, manipulating individual bytes. And because it's bash, it also breaks in confusing ways when you look at it wrong[1]. [1] https://github.com/testssl/testssl.sh/pull/2429

In a similar spirit there is also a site to scan security headers of any site [1] and another to verify the TLS settings from the Mozilla SSL Configuration Generator [2] and a git repo with code to scan sites from the command line [3] useful if the site is not reachable on the internet or automated scans to HTML reports. [1] - https://securityheaders.com/ [2] - https://www.ssllabs.com/ssltest/ [3] - https://github.com/testssl/testssl.sh

Seems like they support more than 3DES. It might be interesting if they shared stats on how many legit MTA's are using old ciphers. Should exclude bots, scanners, etc... There are of course other mitigating factors such as PGP encrypting emails, accepting that some information is still disclosed. That can be further mitigated by using gmail to only perform the initial communication then go out of band for anything sensitive. SSLv2 not offered (OK) SSLv3 not offered (OK) TLS 1 offered (deprecated) TLS 1.1 offered (deprecated) TLS 1.2 offered (OK) TLS 1.3 offered (OK): final Testing cipher categories NULL ciphers (no encryption) not offered (OK) Anonymous NULL Ciphers (no authentication) not offered (OK) Export ciphers (w/o A