testssl.sh: Testing TLS/SSL encryption

• To provide a clear output, so that you can tell whether anything is good or bad
• Ease of installation: It works for Linux, BSD and MSYS2 out of the box (Mac OS X: see below) – no need to install or configure something, no gems, CPAN, pip or the like.
• Reliability: features are tested thoroughly -- even before committing in the development branch
• Freedom: It's 100% open source. You can look at the code, see what's going on and you can change it. Heck, even the development is open (github)
• Flexibility: You can test any SSL/TLS enabled service, not only webservers at port 443
• Privacy: It's only you who sees the result, not a third party
• If a particular check cannot be performed because of a missing capability on your client side, you'll get a warning

• "only one cmd line option at a time" is completely gone
• several tuning parameters on the cmd line (only available through environment variables b4): --assuming-http, --ssl-native, --sneaky, --warnings, --color, -- debug, --long
• certificate information
• more HTTP header infos (cookies+security headers)
• protocol check via bash sockets for SSLv2+v3
• debug handling significantly improved (verbosity/each function leaves files in $TEMPDIR)
• BEAST check
• FREAK check
• check for Secure Client-Initiated Renegotiation
• lots of cosmetic and maintainability code cleanups
• bugfixing

userid@somehost:~ % testssl.sh

testssl.sh <options> 

where <options> is one of

   <-h|--help>                 what you're looking at
   <-b|--banner>               displays banner + version
   <-v|--version>              same as above
   <-V|--local>                pretty print all local ciphers
   <-V|--local> <hexcode>      what cipher is <pattern hexcode>?


testssl.sh <options> URI

   <-e|--each-cipher>          check each local ciphers remotely 
   <-E|-ee|--cipher-per-proto> check those per protocol
   <-f|--ciphers>              check cipher suites
   <-p|--protocols>            check TLS/SSL protocols only
   <-P|--preference>           displays the servers picks: protocol+cipher
   <-y|--spdy>                 checks for SPDY/NPN
   <-x|--single-ciphers-test> <pattern>  tests matched <pattern> of cipher
   <-B|--heartbleed>           tests only for heartbleed vulnerability
   <-I|--ccs|--ccs_injection>  tests only for CCS injection vulnerability
   <-R|--renegotiation>        tests only for renegotiation vulnerability
   <-C|--compression|--crime>  tests only for CRIME vulnerability
   <-T|--breach>               tests only for BREACH vulnerability
   <-0|--poodleh>              tests only for POODLE vulnerability
   <-s|--pfs|--fs|--nsa>       checks (perfect) forward secrecy settings
   <-4|--rc4|--appelbaum>      which RC4 ciphers are being offered?
   <-H|--header|--headers>     check for HSTS and server banner string

   <t|--starttls> protocol     does a default run against a STARTTLS enabled service


partly mandatory parameters:

  URI           host|host:port|URL|URL:port   (port 443 is assumed unless otherwise specified)
  pattern       an ignore case word pattern of cipher hexcode or any other string in the name, kx or bits
  protocol      is one of ftp,smtp,pop3,imap,xmpp,telnet (for the latter you need e.g. the supplied openssl)

userid@somehost:~ %

testssl.sh --starttls smtp <smtphostname>.<tld>:587 
testssl.sh -t xmpp <jabberhostname>.<tld>:5222 
testssl.sh --starttls pop3 <pophostname>.<tld>:110

• one cannot check 56 Bit ciphers as they are disabled during compile time.
• some ciphers are disabled for security reasons,
• support maybe not included (to disable CRIME)
• SSLv2 is often disabled
• and last but not least: SSLv3 seems to be outphased too

export
OPENSSL=<path_to_myopenssl>

OPENSSL=<path_to_myopenssl> testssl.sh <hostname>