Checking TLS/SSL/certificate configuration

TLS_Checking.md

TLS configuration checking

Using online tools

• SSL Labs by Qualys
• htbridge
• digicert
• Checking/configuring certificate chain

SSL Labs is great, but only support port 443. `htbridge and digicert allows to use a custom port.

Using command line tools

• OpenSSL s_client
• testssl.sh
• check_ssl_cert
• cipherscan
• TLS Observatory

OpenSSL

OpenSSL s_client can make TLS connections to any endpoint. It's the underlying tool for lots of other tools.

echo 0 | openssl s_client -ign_eof -prexit -connect $HOST:$PORT
# Enabling TLSv1.0 (disabled by default as unsecure)
echo 0 | openssl s_client -ign_eof -prexit -connect $HOST:$PORT -tls1

Testssl.sh

testssl.sh is a great and complete SSL test tool.

# Testing with standard CAs
testssl.sh $HOST:$PORT
# Testing with IGTF CAs
export CA_BUNDLES_PATH=/etc/grid-security/certificates
testssl.sh $HOST:$PORT

check_ssl_cert

check_ssl_cert is a nagios probes used by EGI Monitoring.

git clone https://github.com/matteocorti/check_ssl_cert
cd check_ssl_cert
# Testing with standard CAs
./check_ssl_cert -p $PORT -H $HOSTNAME
# Testing with IGTF CAs
./check_ssl_cert -p $PORT -H $HOSTNAME -r /etc/grid-security/certificates
# Testing (broken!!) TLSv1.0 support with IGTF CAs
./check_ssl_cert -p $PORT -H $HOSTNAME -r /etc/grid-security/certificates --tls1
# Debugging
./check_ssl_cert -p $PORT -H $HOSTNAME -d
sh -x ./check_ssl_cert -p $PORT -H $HOSTNAME -d

Testing using curl

curl -tls1_0 https://tlstest.paypal.com
curl -tls1_1 https://tlstest.paypal.com
curl -tls1_2 https://tlstest.paypal.com
curl -tls1_3 https://tlstest.paypal.com

TLS versions

• TLSv1.0
• TLSv1.1
• TLSv1.2
• TLSv1.3

TLS vulnerabilities

• GracefulSecurity: TLS/SSL Vulnearibilities
• digicert: Deprecating TLS 1.0 & 1.1
• Comodo: Deprecation of TLSv1.0
• GlobalSign: It’s Time to Disable TLS 1.0 (and All SSL Versions) If You Haven’t Already
• NCSC.nl: guidelines for TLS configuration

TLS Deprecation

TLSv1.0 and TLSv1.1 support is expected to be dropped by major browsers in March 2020.

• Google: Modernizing Transport Security
• Mozilla deprecating TLSv1.0 and TLSv1.1
• Apple deprecating TLSv1.0 and TLSv1.1
• Microsoft deprecating TLSv1.0 and TLSv1.1

To be avoided

• SSLv3 (and before)
• TLSv1.0 (see RFC draft for deprecation)
• TLSv1.1 (see RFC draft for deprecation)

To be used

• TLSv1.2
• TLSv1.3 (when available)

TLS Config generator

• Mozilla: Server Side TLS
• Mozilla TLS config generator

Checking client certificates

• https://www.eugridpma.org/your-identity/
• http://wlcg.web.cern.ch/getting-started/certificates/test