Threat Level: green Handler on Duty: Brad Duncan

SANS ISC: Security Testing SSL/TLS (HTTPS) Implementations - SANS Internet Storm Center SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
Security Testing SSL/TLS (HTTPS) Implementations

During the last few months we have talked about improvements on your SSL/TLS (HTTPS) implementation, for example through the usage of newly supported HTTP headers, such as Strict-Transport-Security (available since Firefox 4). Besides that, and due to the fact there have been several serious CA incidents, the general public has been more aware of the weaknesses of the current Internet PKI the digital commerce is based on.

Leaving apart the current Internet PKI and weak trust CA model, I want to mention a tool we released a few weeks back called TLSSLed. Today, version 1.1 has been released. Its goal is helping organizations to test their SSL/TLS (HTTPS) implementation for common flaws and misconfigurations on web servers  / applications.

The current (version 1.1) tests include verifications to check if the target website supports the SSLv2 protocol, the NULL cipher, weak ciphers based on their key length (40 or 56 bits), the availability of strong ciphers (like AES), if the digital certificate is MD5 signed, if secure SSL/TLS renegotiation capabilities are available, details about the certificate public key length, the certificate subject and issuer (CA), as well as the validity period, plus tests for the existence of HTTP secure headers, such as Strict-Transport-Security and cookies with and without the "secure" flag set.

The tool can be downloaded from Taddong's labs page.

The tool is just a Linux shell script, so I encourage you to inspect it, and contribute improvements and new tests (you can simple send me an e-mail or add comments below). Future versions will incorporate them.

Time to improve your web sever / application SSL/TLS (HTTPS) implementation!

Raul Siles
Founder and Senior Security Analyst with Taddong

Raul Siles

152 Posts
Jul 10th 2011
you mean like this?
If you'd like contributions made, consider posting it on

12 Posts

Sign Up for Free or Log In to start participating in the conversation!