5 ms·
SSL Scan is good, but the industry standard for server configuration scanning is SSL Labs: https://www.ssllabs.com/index.htm https://www.ssllabs.com/index.htm
by vtlynch 11y ago
SSL Scan is good, but the industry standard for server configuration scanning is SSL Labs:
https://www.ssllabs.com/index.htm https://www.ssllabs.com/index.htm
- majelix 11y agoHow would you go about testing your internal endpoints?
- josquin 11y agoUse Nmap's SSL scripts. Especially useful for scanning STARTTLS non-web services like SMTP, POP3, and IMAP.
- Twirrim 11y agoAgreed, but not everything is public facing, and sometimes you need quick verification. ssllabs is great and should definitely be done on all external endpoints, but it takes a while to run.
- packetized 11y agoSo, two things. First, the link is missing an 'l' at the end. [0] Second, exactly what makes SSL Labs the 'industry standard'? I'm well-aware of their services and use in the industry, but I would tend to think that the actual RFCs are industry standard, and not a rather specious high-school grading system for whether a particular TLS provider is secure. [0] https://www.ssllabs.com/index.html https://www.ssllabs.com/index.html
- ivanr 11y agoIn my opinion, the high-school grading system is one of the best features of SSL Labs. Most people don't have the time or interest to read the RFCs and follow the issues closely. The grading system help them easily understand what is important and what isn't. (Disclosure: I built SSL Labs.)
- devNoise 11y agoSo I used this site to check my server and then used the Mozilla SSL config generator. This fixed my site and got me to an "A" rating. So at this point the biggest thing I'm looking at is the "Chain issues" line that reads "Contains anchor". Assuming this has something to do with the bundle file I created?