testtls

Test a TLS server on for security

[testtls @testtls_com]

@JeromeDavies1 Sorry for the late reply. This is most likely an error in the https://t.co/hD26ep8O4f scan engine that fails to get the right OSCP headers. There will be an update soon; most likely nothing to worry about. Tell me your domain if you want an individual check.

[testtls @testtls_com]

@JeromeDavies1 That is a bug on our side. The underlying scan engine had that fixed recently and I still need to integrate that into the website. Sorry for that!

[testtls @testtls_com]

The website of https://t.co/fo6dsKkp2K does no longer reference any external resources. Instead we host all JS & CSS on our server. Kicking out CDNs sacrifices some speed for privacy. Do you think it is worth it?

[testtls @testtls_com]

Fixed: scanning TCP ports over #IPv6 for #TLS configuration and vulnerabilities with https://t.co/CTEYVC2srZ is now working again. Sorry for the inconvenience.

[testtls @testtls_com]

Today we fixed an issue where expired intermediate certificates provided by a #TLS server caused https://t.co/CTEYVC2srZ to report an "expired" chain of trust. Even if a trusted root CA certificate upheld a valid chain, like with the today expired DST Root CA X3 from Lets Encrypt

[testtls @testtls_com]

Maybe no single entity has contributed more to spreading #TLS than @letsencrypt - kudos! But simultaneously, LE is becoming a big single-point-of-failure.
Did you know there are alternative CAs providing free certificates and ACME client support, like @zerosslHQ or @buypass?

[testtls @testtls_com]

@yegle The issue has been fixed now. Thanks for bringing that to my attention!
Root cause was a bug in OpenSSL 1.0.2 - see https://t.co/sGafRjoLMS . Upgrading to OpenSSL 1.1 is not an option as https://t.co/CTEYVC2srZ needs to talk to old & rusty servers still..

[testtls @testtls_com]

@yegle After some more research I can acknowledge that there is an issue with Let's Encrypt's DST Root CA X3 expiration. Servers that include the full certificate chain (as recommended by LE for Android devices) get detected as "Chain Of Trust: failed (expired)". Will keep you posted.

[testtls @testtls_com]

@yegle Yes, that should be handled correctly. Keep in mind that the server certificate determines the chain upwards till the CA cert. If you tell me the domain, I will cross-check that for you.

[testtls @testtls_com]

I love how @letsencrypt is making the Internet a more secure place. But with their huge success we are centralizing #TLS #certificate issuance and creating a single point of failure. Shouldn't there be a dozen or so independent letsencrypts?

[testtls @testtls_com]

Glad to seeing a web browser finally supporting a much needed #security feature #HTTPS-only-mode: https://t.co/KM9xW6QzuC I hope that the over vendors will follow #Firefox on this feature.

[testtls @testtls_com]

Small feature but nevertheless: #download of the #certificate from your #SSL/#TLS service is now possible on https://t.co/CTEYVC2srZ. I am embedding those using "data" URL scheme with base64 encoding; do all browsers support that?

[testtls @testtls_com]

After adding some 💕 you can now scan any TCP port for #SSL/#TLS issues on https://t.co/RlNdUXiBe9 - just enter "host:port" or "IP:port". Oh, yes #IPv6 works as well. What bad config did you find?

[testtls @testtls_com]

Big thanks to everyone giving lots of feedback during the last week via Twitter and Reddit. First improvement: scanning IPv6 targets with TestTLS is now also possible. Does that work for you as expected? Please like. If not, please comment.

[testtls @testtls_com]

@yschimke Client compatibility is taken from ssllabs API via https://t.co/hD26ep8O4f - see https://t.co/9MxjvFyNHg

Android docs at https://t.co/Xg6qdAyVSb claim that TLS 1.2 client sockets are available from Jelly Bean (4.1) but enabled by default only from Lollipop (5.0) only. So YMMV.

[testtls @testtls_com]

Super excited to launch a new service to test the #tls #security of your server: Check out https://t.co/AsiemfpVub - not just for HTTPS but many other ports. What do you think?

[testtls @testtls_com]

@digininja @BeanBagKing Currently it is one single call but for faster tests I will run smaller chunks in parallel later. Retesting only failed items is a good idea to speed things up. Until you break one part while trying to repair another. Maybe prioritize the failed part then trigger a full scan?

[testtls @testtls_com]

@digininja @BeanBagKing Showing the command in the report alongside the versions makes sense and will improve transparency for the users.

Not sure what you mean by the second part. Retesting findings on the CLI?

[testtls @testtls_com]

@digininja Thanks for the feedback! Scoring is high on my wish list as well. Just not sure if I should apply the scoring rules from SSLlabs or create my own set of rules. I like compatibility.