6 ms·
Show HN: SSL Decoder – An open-source alternative for the SSL Labs server test
- mdewinter 12y agoMy weekend project. * Tries to give all the information you need instead of a rating. * Open source, so you can self host it. * Does the entire certificate chain. * Allows to paste a CRL/Cert * Validates the certificate, chain, CRL and OCSP (of every cert in the chain) * Has easy copy-pastable PEM versions of certs * Ciphersuite enumeration as an option. * Fast.
- david_shaw 12y agoThis is pretty great (and you even managed to snag a short domain name)! For those who are trying to use the command line (rather than a webapp), "sslscan" performs these checks from a simple CLI tool.
- billyhoffman 12y ago+1 to SSLScan. Last time I checked though, the Windows builds don't work/support the XML output option. Automating this last year involved capturing STDOUT and regexing...
- toomuchtodo 12y agoThank you so much for this. Can I fork it to add the ability to accept an HTTP POST for the domain/hostname, and return the persistent results URL back to a webhook? (Slack integration)
- mdewinter 12y agoI do have a JSON (plain text, readable json) output endpoint planned, but that will be GET as well. Pull requests are welcome though.
- mdewinter 12y agoIt also does custom ports and protocols, for example 8443, 465 (SMTP), 994/995(POP/IMAP) etc.
- zaphoyd 12y agoCustom ports and IPv6 support <3
- simon_vetter 12y agoThanks for doing this, awesome job. May I request IPv6 support?
- zaphoyd 12y agoAs far as I can tell the website is accessible via IPv6 and you can run checks on IPv6 only servers. What is missing?
- simon_vetter 12y agoIf your hostname is dual stacked it only checks for ipv4 afaik.
- Silhouette 12y agoNice. Friendly suggestion: Show a prominent summary at the top of the report of any areas of concern.
- mdewinter 12y agoThat's a good idea. Chain issues are already reported, but expiry or validation errors should be prominent as well.
- jamescun 12y agoI started to build a similar thing, for the command line, last year but did not get as far. https://github.com/jamescun/ssltest https://github.com/jamescun/ssltest
- cookiecaper 12y agoThanks. Just needed something like this last week.
- carsonreinke 12y agoFunny, looked up Gmail and they are still allowing SSL3
- bodyfour 12y agoWith browsers supporting TLS_FALLBACK_SCSV the SSL3 risk isn't that great since an MITM attack can't force a downgrade. Therefore SSL3 should only end up being used by old clients that don't support anything newer. Organizations running such huge websites need to be conservative about dropping support -- even if it only bites 0.01% of users that can be a huge population!
- tracker1 12y agoDamn you IE8 and Android 2!!!
- baconhigh 12y ago"PHP must allow shell_exec and remote fopen." ouch.
- smt88 12y agoNot a big deal if you're self-hosting. Put it in a Docker container (on your own machine or one of your servers), run it when you need it, and then shut it down. For a permanent solution, get a very small Digital Ocean server, install this with the requested unsafe settings, and let the machine be dedicated to this. Even if someone compromised the machine, they wouldn't get anything of interest.
- jjoe 12y agoIt's not about finding anything of interest in the server. It's the negative impact this server and many others like it have on others when they're leveraged in an attack.
- smt88 12y agoI definitely do not support having unmonitored servers. If your server is used in an attack, you should see a traffic spike and shut it down. I also meant to say that any server used for this purpose should be firewalled so that only your IP can access it.
- jjoe 12y agoAn outward attack from this server against another doesn't necessarily register in bandwidth graphs. It all depends on the type of attack.
- abarringer 12y agoThanks, looks great! I'd like to see a check for SSLv2. For instance this site supports sslv2 and it should be flagged: download.biscom.com. https://www.ssllabs.com/ssltest/analyze.html?d=download.biscom.com https://www.ssllabs.com/ssltest/analyze.html?d=download.bisc...
- eyeareque 12y agoNice work. This will help a lot of people who audit sites.. and its great to have an open alternative to the closed source ssllabs tester.
- MichaelGG 12y agoFeature/bug: It doesn't seem to attempt to explicitly negotiate older protocols. For instance, I'm dealing with a site that still has SSLv2 and export ciphers enabled if a client requests it. (Like, if I run openssl s_client -ssl2.) SSLlabs detects this, but tls.so doesn't.
- mdewinter 12y agoKnown issue. Have to look in to that...
- billyhoffman 12y agoI really like the nice big horizontal check marks for the "health" of each aspect of the certificates. Thank you for releasing this.
- gkoz 12y agoWhy are certificate serials highlighted in red?
- mdewinter 12y agoNo particular reason. What would you do different?
- yrro 12y agoI've tweaked my Apache configuration but don't seem to be able to trigger a rescan--the cipher list doesn't appear to change. I guess it's cached for a little while, but the UI doesn't make that clear. Also, it's flagging the following ciphers: ECDHE-RSA-DES-CBC3-SHA EDH-RSA-DES-CBC3-SHA DES-CBC3-SHA These are triple-DES though, rather than just single DES. Is that considered weak these days?
- nuxi7 12y agoThey have 112-bits of security and are considered fine until 2030 by NIST. (insert opinion of NIST here) The real reason to disable them is because of how slow they are. The only thing that is gonna actually use 3DES for TLS is MSIE on XP, its the last remaining secure cipher.
- owly 12y agoSeriously, nice work!
- owly 12y agoSeriously, nice work!
- deleted 12y ago[deleted]
- iancarroll 12y agoFew notes: - Does not enumerate ChaCha20 - Doesn't detect BoringSSL - try running it on certly.io
- mdewinter 12y agoChaCha20 support is not in Openssl 1.0.2 yet, only an outdated dev branch. When it's in, it'll support it. How would I detect boringssl?
- deathanatos 12y agoThese services always dock me for including RC4 ciphers. I understand that these are bad because RC4 is broken or near broken; I shouldn't be using it. However, I'm simply using load balancering sevices provided by AWS and Rackspace; my understanding is that (since they perform SSL termination) it is their software on the load balancer that chooses the ciphers, and as far as I know, I cannot change this. Are they misconfigured? (why?) Is there any way to work around it short of doing the load balancing myself?
- wampus 12y agoIt appears AWS lets you configure this[1]. You may have chosen a policy and never changed it. A note on that page says if you don't choose a policy, you'll always use the latest one. It looks like you can create a custom one, as well. [1]http://docs.aws.amazon.com/ElasticLoadBalancing/latest/DeveloperGuide/configure-ssl-ciphers.html http://docs.aws.amazon.com/ElasticLoadBalancing/latest/Devel...
- spydum 12y agorc4 may be "bad", but if you notice, it is so densely deployed on clients, it's hard to avoid.
- simon_vetter 12y agoUse these services as tcp load balancers and terminate SSL on your backends. Using a LB to offload SSL termination might seem like a good idea (you save a bit of CPU, really not more than a few percent in practice), but you expose your customer traffic to capture/inspection between the LB and your backends. This network can span multiple hops or even datacenters. Also, when the next openssl vuln hits, you can patch your setup in no time and do not need to wait for the LBs to be patched at your vendor's will.
- smy1es 12y agoNice work. How do you determine the destination SSL library?
- humanarity 12y agoThank you for putting this all together and making it open source. By the way, will you be releasing an API? I think this API would be really valuable.