TESTSSL(1) General Commands Manual TESTSSL(1) (NAME) testssl (NAME) testssl.sh - SSL/TLS (SYNOPSIS) testssl.sh [OPTIONS] , testssl.sh [OPTIONS] --file testssl.sh [BANNER OPTIONS] (DESCRIPTION) testssl.sh TLS/SSL . ( ) ( ) . ( ) . . . (LAN) . DNS testssl.sh . (REQUIREMENTS) testssl.sh (portable) : Linux *BSD MacOS X WSL ( ) Cygwin MSYS2 . bash . awk sed tr head . BSD System 5 GNU grep System V . OpenSSL LibreSSL . testssl.sh (TCP) . OpenSSL (statically linked) ./bin/ . (GENERAL) testssl.sh URI << >> (default run) (ANSI termcap) . -E : ) ( ) DNS IP IP (reverse lookup) . . ) SSL/TLS ) ) ( ) ) (forward secrecy): ) ( TLS ) ) HTTP ( HTTP --assume-http) ) ) ) ) (OPTIONS AND PARAMETERS) . testssl.sh -t=smtp --wide --openssl=/usr/bin/openssl ( ) testssl.sh --starttls smtp --wide --openssl /usr/bin/openssl ( ). . WIDE=true OPENSSL=/usr/bin/openssl testssl.sh --starttls=smtp . . --file . (BANNER OPTIONS) --help ( ) . -b, --banner testssl.sh testssl.sh openssl openssl . -v, --version . -V [pattern], --local [pattern] openssl . (pattern) ( ) (wide) . : (hexcode) (OpenSSL IANA) . (word pattern match) . [0-9,A-F] . ( ) CBC AES . --openssl= . (INPUT PARAMETERS) URI IPv4 IPv6 ( ) (URL) . IPv6 () . . https . IP (vhost) . DNS ( A/AAAA) /etc/hosts . --file -iL . --warnings batch . fname . fname testssl . # EOF fname . testssl.sh --wide --log --file . fname . . . fname grep nmap ( -oG) . . . testssl.sh nmap -t smtp URI TLS/SSL STARTTLS SMTP . nmap STARTTLS/ testssl.sh . Nmap IP PTR DNS . nmap IP ( A AAAA) testssl.sh . A IP IP . IP . grep nmap testssl.sh : 10.10.12.16:443 10.10.12.16:1443 -t smtp host.example.com:25 host.example.com:443 host.example.com:631 -t ftp 10.10.12.11:21 10.10.12.11:8443 fname . (DOS carriage returns) . FNAME . --mode . () (--parallel --serial ). (serial) . MASS_TESTING_MODE serial parallel . --warnings . testssl.sh . : batch 3.0 . (--file) . off . testssl.sh . testssl.sh . WARNINGS . --connect-timeout TCP . TCP ( IDS tarpit) testssl.sh . testssl.sh seconds . timeout . CONNECT_TIMEOUT . --openssl-timeout openssl . openssl . seconds testssl.sh openssl . timeout . timeout . OPENSSL_TIMEOUT . --basicauth HTTP (Basic Auth) . BASICAUTH . --reqheader
HTTP Headername: headercontent . : --reqheader 'Proxy-Authorization: Basic dGVzdHNzbDpydWxlcw==' --reqheader 'ClientID: 0xDEADBEAF'. REQHEADER . (SPECIAL INVOCATIONS) -t , --starttls protocol STARTTLS . protocol : ftp smtp pop3 imap xmpp sieve xmpp-server telnet ldap irc lmtp nntp postgres mysql. OpenSSL 1.1.1 OpenSSL . : MongoDB STARTTLS IRC --ssl-native . irc . --xmpphost XMPP STARTTLS : jabber . URI . --mx MX ( STARTTLS ) . --ip () IPv4 IPv6 . IPv6 . --ip=one : A DNS ( IP ). -6 --ip=one AAAA . --ip IP /etc/hosts /c/Windows/System32/drivers/etc/hosts . --ip=proxy DNS (proxy) . --ip=proxy --nodns=min DNS CAA TXT MX DNS . --proxy : (proxy) . --proxy=auto . A AAAA . IPv4 IPv6 () . IPv6 OpenSSL LibreSSL . DNS_VIA_PROXY=true . OCSP ( -S --phone-out) OpenSSL . OCSP . IGN_OCSP_PROXY=true . . IPv6 HTTPS SOCKS . -6 IPv6 () . testssl.sh IPv6 : testssl.sh IPv6 OpenSSL s_client IPv6 . -6 . IPv6 HAS_IPv6 . OpenSSL IPv6 OpenSSL 1.1.0 1.0.2 RHEL/CentOS/FC Gentoo . --ssl-native bash s_client openssl testssl.sh () . . testssl.sh . (false negatives) . openssl . --openssl testssl.sh ( testssl.sh testssl.sh ). openssl ($PATH) . testssl.sh openssl ( OPENSSL=). OpenSSL . OpenSSL 3.X OpenSSL MacOS 18 LibreSSL . (TUNING OPTIONS) --bugs (padding) F5. -bug openssl s_client(1) ( BUGS="-bugs" ). testssl.sh . --assuming-http testssl.sh . HTTP . testssl.sh HTTP ( HTTP) . SHA1 SAN . -n, --nodns testssl.sh DNS . min DNS ( A AAAA MX) CAA PTR IP . none DNS . IP --ip IP /etc/hosts . DNS . (timeout) DNS . NODNS . --nodns=min --ip=proxy DNS CAA TXT MX . --sneaky HTTP testssl.sh (User Agent) TLS tester from ${URL} . Firefox . ( SNEAKY=true). --user-agent testssl.sh TLS tester from ${URL} HTTP . --ids-friendly (IDS) . : Heartbleed CCS Injection Ticketbleed ROBOT. OFFENSIVE false . USLEEP_SND / USLEEP_REC MAX_WAITSOCK . --phone-out CRL OCSP . testssl.sh URI - - . ( CRL) testssl.sh . PHONE_OUT true . --add-ca (CA) PEM . CAfile .pem CA . CA . () CA . ADDTL_CA_FILES . (SINGLE CHECK OPTIONS) testssl.sh . . -e, --each-cipher ( ) openssl + (wide) . --show-each . : hexcode OpenSSL cipher suite name key exchange encryption bits IANA/RFC cipher suite name. --mapping . bit security ( ) . 3DES (Meet-in-the-Middle) . -E, --cipher-per-proto -e, --each-cipher . : . --show-each . . -s, --std, --categories / . (--standard .) (openssl ciphers $LIST $LIST ): O (NULL): 'NULL:eNULL' O NULL: 'aNULL:ADH' O (Export) ( ): 'EXPORT:!ADH:!NULL' O LOW ( + DES EXPORT): 'LOW:DES:RC2:RC4:MD5:!ADH:!EXP:!NULL:!eNULL:!AECDH' O 3DES + IDEA: '3DES:IDEA:!aNULL:!ADH:!MD5' O CBC: 'HIGH:MEDIUM:AES:CAMELLIA:ARIA:!IDEA:!CHACHA20:!3DES:!RC2:!RC4:!AESCCM8:!AESCCM:!AESGCM:!ARIAGCM:!aNULL:!MD5' O (FS) ( AEAD): 'AESGCM:CHACHA20:CamelliaGCM:AESCCM:ARIAGCM:!kEECDH:!kEDH:!kDHE:!kDHEPSK:!kECDHEPSK:!aNULL' O (FS) ( AEAD): 'AESGCM:CHACHA20:CamelliaGCM:AESCCM:ARIAGCM:!kPSK:!kRSAPSK:!kRSA:!kDH:!kECDH:!aNULL' -f, --fs, --nsa, --forward-secrecy (Forward Secrecy) . <<>> (Null) 3DES RC4 . . - (Diffie Hellman) FFDHE ( TLS 1.2 TLS 1.3) . -p, --protocols TLS/SSL SSLv2 SSLv3 TLS 1.0 TLS 1.3 HTTP SPDY (NPN) ALPN ( HTTP/2) . TLS 1.3 ( ) . openssl-bad TLS 1.3 . TLS 1.3 . TLS 1.3 ( ) TLS 1.3 /usr/bin/openssl ( OPENSSL2) . . -P, --server-preference, --preference : openssl : . (openssl+) . . -S, --server_defaults () Server Hello : O TLS O / TLS ticket (session ID) O (session resumption) O (Time skew) localhost ( ). O O O O (key usage and extended key usage) O O (CN) (SAN) O + O (EV) O <> O : + ( ) O (CRL OCSP OCSP stapling must staple). --phone-out (OCSP CRL ). O DNS ( CAA) O (Certificate Transparency) ( ). . . (CA) ADDTL_CA_FILES (FILES) . (SAN) (CN) . Server Hello SNI ( ) IP . TLS: . TLS gmt_unix_time IIS openssl < 1.0.1f. HTTP TLS HTTP . -x , --single-cipher pattern . -V pattern , --local pattern . -h, --header, --headers HTTP ( --assume-http) HTTP : O (HSTS) O HTTP (HPKP) O O HTTP O .IP "O" 4 (PHP RoR OWA SharePoint Wordpress ) O Reverse proxy O O IPv4 O ( Secure/HTTPOnly) O BIG IP F5 O (X-Frame-Options X-XSS-Protection Expect-CT... CSP). . -c, --client-simulation . Forward Secrecy. testssl.sh API SSLlabs . --wide . ALL_CLIENTS . -g, --grease GREASE RFC 8701 . . (VULNERABILITIES) -U, --vulnerable, --vulnerabilities ( ) . VULN_THRESHLD . 1 . . renegotiation Logjam . -H, --heartbleed Heartbleed openssl . heartbeat . HEARTBLEED_MAX_WAITSOCK . 8 . -I, --ccs, --ccs-injection CCS Injection openssl . . 5 CCS_MAX_WAITSOCK . -T, --ticketbleed Ticketbleed BigIP . --BB, --robot ROBOT / (Return Of Bleichenbacher's Oracle Threat) . 10 ROBOT_TIMEOUT . --SI, --starttls-injection STARTTLS ( SMTP IMAP POP3). socat OpenSSL >=1.1.0 . -R, --renegotiation renegotiation ( ) . Secure Renegotiation Secure Client-Initiated Renegotiation . DoS (HTTP). Insecure Client-Initiated Renegotiation . -C, --compression, --crime CRIME (Compression Ratio Info-leak Made Easy) TLS . CRIME SPDY . -B, --breach BREACH (Browser Reconnaissance and Exfiltration via Adaptive Compression of Hypertext) . HTTP HTTP --assume-http . URL ( "/" ) . -O, --poodle SSL POODLE (Padding Oracle On Downgraded Legacy Encryption) . CBC SSLv3 . -Z, --tls-fallback TLS_FALLBACK_SCSV . TLS_FALLBACK_SCSV Client Hello Man in the Middle . -W, --sweet32 SWEET32 (3DES RC2 IDEA) . -F, --freak FREAK (Factoring RSA Export Keys) EXPORT RSA . -D, --drown DROWN (Decrypting RSA with Obsolete and Weakened eNcryption) SSL 2 . RSA . testssl.sh censys.io . -J, --logjam LOGJAM DH EXPORT . << >> DH . DH . FFDHE ( TLS 1.2) . -A, --beast BEAST SSL 3 TLS 1.0 CBC . -L, --lucky13 LUCKY13 . CBC TLS 1.0 1.2 . -WS, --winshock Winshock . TLS ec Windows . . -4, --rc4, --appelbaum RC4 . (OUTPUT OPTIONS) -q, --quiet testssl.sh stdout . . . --wide << >> ( ). testssl.sh : BEAST FS RC4. . . WIDE . --mapping O openssl: OpenSSL () O iana: IANA . O no-openssl: OpenSSL IANA . O no-iana: IANA OpenSSL . 3.0 testssl.sh rfc iana no-rfc no-iana 3.0 . --show-each wide : -- . SHOW_EACH_C . --color <0|1|2|3> : 2 ANSI termcap . 1 . 0 = . . 3 EC ( ) . COLOR . OpenBSD FreeBSD . --colorblind ( ) . COLORBLIND . --debug <0-6> (2-6) . DEBUG . (0 ): 1. /tmp/testssl.XXXXXX/ . . 2. ( ) 3. : hexdumps + 4. 5. 6. --disable-rating . ( ) . (FILE OUTPUT OPTIONS) --log, --logging ${NODE}-p${port}${YYYYMMDD-HHMM}.log . ( ) --color 0 . cat -- less -- . . testssl.sh . testssl.sh . TERM_WIDTH . --logfile -oL . logfile logfile/${NODE}-p${port}${YYYYMMDD-HHMM}.log . logfile . LOGFILE . testssl.sh . TERM_WIDTH . --json JSON ${NODE}-p${port}${YYYYMMDD-HHMM}.json . JSON --json-pretty -- / IP . CVE CWE . . --jsonfile -oj JSON . jsonfile logfile/${NODE}-p${port}${YYYYMMDD-HHMM}.json . jsonfile . --json-pretty JSON ${NODE}-p${port}${YYYYMMDD-HHMM}.json . JSON --json -- . openssl testssl . testssl.sh / JSON . / . CVE CWE . . --jsonfile-pretty -oJ --jsonfile --logfile JSON ( --json-pretty ) . --jsonfile --logfile . --csv CSV ${NODE}-p${port}${YYYYMMDD-HHMM}.csv . JSON ( / IP CVE CWE). --csvfile -oC --jsonfile --logfile CSV ( --cvs ) . --jsonfile --logfile . --html HTML ${NODE}-p${port}${YYYYMMDD-HHMM}.html . : . <> (Ansi HTML Adapter: github.com/theZiz/aha) testssl.sh [options] | aha >output.html. . --htmlfile -oH --jsonfile --logfile HTML ( --html ) . --jsonfile --logfile . -oA / --outFile nmap : LOG JSON pretty CSV HTML. auto '${NODE}-p${port}${YYYYMMDD-HHMM}.${EXT}' . /${NODE}-p${port}${YYYYMMDD-HHMM}.{log,json,csv,html} . -oa / --outfile JSON . --hints . . GIVE_HINTS . --severity CSV JSON severity . . WARN . . --append testssl.sh . --append . APPEND . / . . --overwrite testssl.sh . . OVERWRITE . ! --outprefix fname_prefix ${NODE}- . FNAME_PREFIX . -${NODE}-p${port}${YYYYMMDD-HHMM}. . <<->> <<.>> <<_>> <<,>> . <<->> <<->> . ..SS " (COLOR RATINGS)" testssl.sh () . : O : (critical) O : (high) O : (medium) O : (low) O ( COLORBLIND): O ( COLORBLIND): O : (info) O : --show-each O : O : testssl.sh <<>> (light) <<>> (bold) . --color=3 . ( ) : O (bold): O + : O : O (italics): (TUNING via ENV variables and more options) . . testssl.sh . O TERM_WIDTH . --log --logfile -oL . O DEBUG_ALLINONE / SETX: true testssl.sh bash bash -x testssl.sh bash /tmp/testssl-.log O DEBUGTIME: . bash true epoch /tmp/testssl-.time . paste /tmp/testssl-.{time,log} . [comment]: # * FAST_SOCKET [comment]: # * SHOW_SIGALGO [comment]: # * FAST O EXPERIMENTAL=true . . O ALL_CLIENTS=true HTTP ( ) . O UNBRACKTD_IPV6: OpenSSL ( Gentoo) IPv6 true . O NO_ENGINE: <> true . testssl.sh engine libressl . O HEADER_MAXSLEEP: / HTTP . O MAX_WAITSOCK: testssl.sh . . . O CCS_MAX_WAITSOCK CCS CCS . . . O HEARTBLEED_MAX_WAITSOCK MAX_WAITSOCK ServerHello Heartbleed . . . O ROBOT_TIMEOUT ROBOT . O MEASURE_TIME_FILE false . O STARTTLS_SLEEP 10 () . testssl.sh STARTTLS . O MAX_PARALLEL . . O MAX_WAIT_TEST ( ) . . [comment]: # USLEEP_SND [comment]: # USLEEP_REC O HSTS_MIN 179 () . HTTP Strict Transport Security . O HPKP_MIN 30 () . HTTP Public Key Pinning . O DAYS2WARN1 60 () . Let's Encrypt . O DAYS2WARN2 30 () . Let's Encrypt . O TESTSSL_INSTALL_DIR testssl.sh . bin etc . O CA_BUNDLES_PATH: CA testssl.sh CA testssl.sh . testssl.sh . ~/utils/create_ca_hashes.sh HPKP . O MAX_SOCKET_FAIL: testssl.sh TCP . 2 . Fatal error: repeated TCP connect problems, giving up . O MAX_OSSL_FAIL: testssl.sh s_client OpenSSL . 2 . Fatal error: repeated openssl s_client connect problem, doesn't make sense to continue . O MAX_HEADER_FAIL: testssl.sh HTTP GET OpenSSL . 3 . Fatal error: repeated HTTP header connect problems, doesn't make sense to continue . O OPENSSL2 openssl . bin/ TLS 1.3 /usr/bin/openssl . O OSSL_SHORTCUT TLS 1.3 /usr/bin/openssl (OPENSSL2) true . (RATING) <> SSL Labs https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide . <> SSL Labs https://www.ssllabs.com/ssltest/analyze.html . SSL Labs . . . : ! . STARTTLS T . . TLS RFC 8314 . STARTTLS SMTP 25 . DANE MTA-STS . : * GOLDENDOODLE - F * (Insecure renegotiation) - F * AES-NI CBC MAC ( CVE-2016-2107) - F * Sleeping POODLE - F * ( CVE-2019-1559) - F * Zombie POODLE - F * Symantec PKI - T * Symantec - T * (Anonymous key exchange) - 0 set_key_str_score() * (Exportable key exchange) - 40 set_key_str_score() * ( Debian OpenSSL) - 0 set_key_str_score() set_grade_cap() : bash set_grade_cap "D" "Vulnerable to documentation" set_grade_warning() : bash set_grade_warning "Documentation is always right" #### : ( ) set_rating_state() ( $do_mycheck if $nr_enabled ) set_rating_state() . . : * : . . ( ) * * run_rating() (EXAMPLES) testssl.sh testssl.sh https://testssl.sh ( [forward secrecy] ). testssl.sh testssl.net:443 testssl.net IPv4 . . testssl.sh --ip=one --wide https://testssl.net:443 IP . (wide) . testssl.sh -6 https://testssl.net IPv6 -- IPv6 openssl IPv6 ( ). testssl.sh -t smtp smtp.gmail.com:25 STARTTLS 25 . IP smtp.gmail.com . testssl.sh --starttls=imap imap.gmx.net:143 IMAP . TLS STARTTLS : testssl.sh smtp.gmail.com:465 SMTPS testssl.sh imap.gmx.net:993 IMAPS. MongoDB TLS STARTTLS ..SH "RFC (RFCS AND OTHER STANDARDS)" O RFC 2246: The TLS Protocol Version 1.0 O RFC 2595: Using TLS with IMAP, POP3 and ACAP O RFC 2818: HTTP Over TLS O RFC 2830: Lightweight Directory Access Protocol (v3): Extension for Transport Layer Security O RFC 3207: SMTP Service Extension for Secure SMTP over Transport Layer Security O RFC 3501: INTERNET MESSAGE ACCESS PROTOCOL - VERSION 4rev1 O RFC 4346: The Transport Layer Security (TLS) Protocol Version 1.1 O RFC 4366: Transport Layer Security (TLS) Extensions O RFC 4492: Elliptic Curve Cryptography (ECC) Cipher Suites for Transport Layer Security (TLS) O RFC 5077: Transport Layer Security (TLS) Session Resumption O RFC 5246: The Transport Layer Security (TLS) Protocol Version 1.2 O RFC 5280: Internet X.509 Public Key Infrastructure Certificate and Certificate Revocation List (CRL) Profile O RFC 5321: Simple Mail Transfer Protocol O RFC 5746: Transport Layer Security (TLS) Renegotiation Indication Extension O RFC 5804: A Protocol for Remotely Managing Sieve Scripts O RFC 6066: Transport Layer Security (TLS) Extensions: Extension Definitions O RFC 6101: The Secure Sockets Layer (SSL) Protocol Version 3.0 O RFC 6120: Extensible Messaging and Presence Protocol (XMPP): Core O RFC 6125: Domain-Based Application Service Identity [..] O RFC 6797: HTTP Strict Transport Security (HSTS) O RFC 6961: The Transport Layer Security (TLS) Multiple Certificate Status Request Extension O RFC 7469: Public Key Pinning Extension for HTTP (HPKP) O RFC 7507: TLS Fallback Signaling Cipher Suite Value (SCSV) for Preventing Protocol Downgrade Attacks O RFC 7627: Transport Layer Security (TLS) Session Hash and Extended Master Secret Extension O RFC 7633: X.509v3 Transport Layer Security (TLS) Feature Extension O RFC 7465: Prohibiting RC4 Cipher Suites O RFC 7685: A Transport Layer Security (TLS) ClientHello Padding Extension O RFC 7905: ChaCha20-Poly1305 Cipher Suites for Transport Layer Security (TLS) O RFC 7919: Negotiated Finite Field Diffie-Hellman Ephemeral Parameters for Transport Layer Security O RFC 8143: Using Transport Layer Security (TLS) with Network News Transfer Protocol (NNTP) O RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3 O RFC 8701: Applying Generate Random Extensions And Sustain Extensibility (GREASE) to TLS Extensibility O W3C CSP: Content Security Policy Level 1-3 O TLSWG Draft: The Transport Layer Security (TLS) Protocol Version 1.3 (EXIT STATUS) O 0 testssl.sh . O 1 testssl.sh . O 1+n ( IP). O 50-200 CI . O 242 (ERR_CHILD) master . O 244 (ERR_RESOURCE) testssl.sh . O 245 (ERR_CLUELESS) testssl.sh. O 246 (ERR_CONNECT) . O 247 (ERR_DNSLOOKUP) IP. O 248 (ERR_OTHERCLIENT) . O 249 (ERR_DNSBIN) DNS. O 250 (ERR_OSSLBIN) OpenSSL. O 251 (ERR_NOSUPPORT) . O 252 (ERR_FNAMEPARSE) . O 253 (ERR_FCREATE) . O 254 (ERR_CMDLINE) . O 255 (ERR_BASH) Bash . (FILES) etc/*pem Apple Linux Mozilla Firefox Windows Java . etc/client-simulation.txt . etc/cipher-mapping.txt OpenSSL IANA / RFC . etc/tls_data.txt ( bash) . (AUTHORS) Dirk Wetter David Cooper CREDITS.md . (COPYRIGHT) (C) 2012 Dirk Wetter. GPLv2: (Free Software Foundation, Inc.). : LICENSE . () - - . testssl.sh / . . (WITHOUT ANY WARRANTY). (USE at your OWN RISK)!.SH " (LIMITATION)" Windows Linux . (BUGS) . : https://testssl.sh/bugs . (SEE ALSO) ciphers(1) openssl(1) s_client(1) x509(1) verify(1) ocsp(1) crl(1) bash(1) https://testssl.sh https://github.com/testssl/testssl.sh . December 2021 TESTSSL(1)