5 ms·

What features did SSLPing have that forced it to rely so heavily on old versions of OpenSSL?

by dan1234 5y ago

fxtentacle 5y ago
It's also blocked by AdGuard.
- lapser 5y ago
  Yeah I was trying to figure out what was going on here. Is it blocked cos it's closing or was it blocked from before?
capableweb 5y ago
From https://web.archive.org/web/20220328120435/https://sslping.com/ https://web.archive.org/web/20220328120435/https://sslping.c... > SSLPing needs less than 5 seconds to check your server and tell you what's wrong with your SSL/TLS security. So I guess it used OpenSSL to figure out what was wrong with people's certificates. Not sure what it used that relied on internals so heavily it was hard to upgrade, or if the public interface just changed a lot. Even with that, seems there was multiple issues that "prevented" ("made it harder than justifiable" rather) the author from keeping the project up, not just regarding OpenSSL.
- dan1234 5y ago
  Ah ok, so it sounds like an automated (though probably cutdown) version of the SSLLabs server test.
  - WelcomeShorty 5y ago
    It does a little more and little less. More: Enter a list of (sub-) domains and get informed via email when "SSL things" change (for better or for worst), or your https certificate is about to expire. Less: No fancy pansy "report" Personally I prefer https://hardenize.com https://hardenize.com nowadays, over ssllabs for these kind of queries.
    - dan1234 5y ago
      https://hardenize.com https://hardenize.com is quite pretty, but there's nowhere near $999/mo of value in it for me!
      - ivanr 5y ago
        Hardenize's paid plan is intended for larger businesses, where we combine infrastructure discovery with continuous monitoring and many other things. However, ad-hoc assessments are free for everyone and we intend to keep it that way. I hope that we will in time be able to provide plans at lower price points and maybe a free plan at some point. (Hardenize founder, previously also SSL Labs founder.)
- lloeki 5y ago
  My guess: SSLv3 has been dropped from OpenSSL, which means hitting a SSLv3 server just fails to connect quite early in the process, so there would not even be cert reading, plus IIRC the connection error can be very obtuse, which means sslping could not do that: > tell you what's wrong
- weddpros 5y ago
  SSLping creator here... Actually node.js is using openssl under the hood... SSLPing implemented a partial SSL implementation to quickly test support for SSL versions and cyphers, but used node.js native libs too. Newer node.js versions weren't able to get an SSL certificate out of a SSL v3 only server, for instance. Which didn't allow to test for expiration, etc... But yes, there were multiple issues indeed
perlgeek 5y ago
Speculation ahead: It didn't just check if a certificate is valid now, but whether the certificate, intermediary, CA (or anything in the chain) is about to expire soon. It might have needed to poke deeper into OpenSSL than regular uses.
- dan1234 5y ago
  You don’t need anything peculiar in OpenSSL to do that. I’ve been monitoring my ssl certs with a simple nodejs script (it just connects to get the cert details so generally less than a second per domain). Perhaps their service also tested for deprecated ciphers/tls versions?
- weddpros 5y ago
  it did test supported cyphers and SSL versions, common vulnerabilities, etc... (SSLPing creator here)
ivanr 5y ago
SSLPing was a tool that was designed to test SSL/TLS/PKI server configuration. According to the author's message, it was built on top of OpenSSL. There have been significant changes made to OpenSSL since 2016, many focused on improving security by removing very old cryptographic primitives that are obsolete and insecure. Think RC4, 3DES, SHA1, and so on. If you're relying on OpenSSL to detect presence of such primitives on a server, upgrading your own (client) OpenSSL version breaks the functionality. This is a problem for all testing tools that rely on OpenSSL. If you follow this direction, you typically need to use at least two OpenSSL versions, one new to test modern features and one very old to test obsolete features.
- weddpros 5y ago
  Hi Ivan, I know you appreciate the issue to its fullest like no one else! Cheers

What features did SSLPing have that forced it to rely so heavily on old versions of OpenSSL?

fxtentacle 5y ago

It's also blocked by AdGuard.

lapser 5y ago
Yeah I was trying to figure out what was going on here. Is it blocked cos it's closing or was it blocked from before?

capableweb 5y ago

From https://web.archive.org/web/20220328120435/https://sslping.com/ https://web.archive.org/web/20220328120435/https://sslping.c... > SSLPing needs less than 5 seconds to check your server and tell you what's wrong with your SSL/TLS security. So I guess it used OpenSSL to figure out what was wrong with people's certificates. Not sure what it used that relied on internals so heavily it was hard to upgrade, or if the public interface just changed a lot. Even with that, seems there was multiple issues that "prevented" ("made it harder than justifiable" rather) the author from keeping the project up, not just regarding OpenSSL.

dan1234 5y ago
Ah ok, so it sounds like an automated (though probably cutdown) version of the SSLLabs server test.
- WelcomeShorty 5y ago
  It does a little more and little less. More: Enter a list of (sub-) domains and get informed via email when "SSL things" change (for better or for worst), or your https certificate is about to expire. Less: No fancy pansy "report" Personally I prefer https://hardenize.com https://hardenize.com nowadays, over ssllabs for these kind of queries.
  - dan1234 5y ago
    https://hardenize.com https://hardenize.com is quite pretty, but there's nowhere near $999/mo of value in it for me!
    - ivanr 5y ago
      Hardenize's paid plan is intended for larger businesses, where we combine infrastructure discovery with continuous monitoring and many other things. However, ad-hoc assessments are free for everyone and we intend to keep it that way. I hope that we will in time be able to provide plans at lower price points and maybe a free plan at some point. (Hardenize founder, previously also SSL Labs founder.)
lloeki 5y ago
My guess: SSLv3 has been dropped from OpenSSL, which means hitting a SSLv3 server just fails to connect quite early in the process, so there would not even be cert reading, plus IIRC the connection error can be very obtuse, which means sslping could not do that: > tell you what's wrong
weddpros 5y ago
SSLping creator here... Actually node.js is using openssl under the hood... SSLPing implemented a partial SSL implementation to quickly test support for SSL versions and cyphers, but used node.js native libs too. Newer node.js versions weren't able to get an SSL certificate out of a SSL v3 only server, for instance. Which didn't allow to test for expiration, etc... But yes, there were multiple issues indeed

perlgeek 5y ago

Speculation ahead: It didn't just check if a certificate is valid now, but whether the certificate, intermediary, CA (or anything in the chain) is about to expire soon. It might have needed to poke deeper into OpenSSL than regular uses.

dan1234 5y ago
You don’t need anything peculiar in OpenSSL to do that. I’ve been monitoring my ssl certs with a simple nodejs script (it just connects to get the cert details so generally less than a second per domain). Perhaps their service also tested for deprecated ciphers/tls versions?
weddpros 5y ago
it did test supported cyphers and SSL versions, common vulnerabilities, etc... (SSLPing creator here)

ivanr 5y ago

SSLPing was a tool that was designed to test SSL/TLS/PKI server configuration. According to the author's message, it was built on top of OpenSSL. There have been significant changes made to OpenSSL since 2016, many focused on improving security by removing very old cryptographic primitives that are obsolete and insecure. Think RC4, 3DES, SHA1, and so on. If you're relying on OpenSSL to detect presence of such primitives on a server, upgrading your own (client) OpenSSL version breaks the functionality. This is a problem for all testing tools that rely on OpenSSL. If you follow this direction, you typically need to use at least two OpenSSL versions, one new to test modern features and one very old to test obsolete features.

weddpros 5y ago
Hi Ivan, I know you appreciate the issue to its fullest like no one else! Cheers