sslyze: Audits SSL/TLS configurations

sslyze is a powerful Python-based tool that can analyze the SSL/TLS configuration of a server. It performs a wide range of tests and checks, providing detailed information about the server’s security posture. It’s a valuable tool for security professionals, system administrators, and anyone concerned about SSL/TLS security.

What sslyze Does:

sslyze connects to a server’s SSL/TLS port (typically 443 for HTTPS) and performs various tests, including:

• SSL/TLS Version Support: Identifies supported SSL/TLS versions (SSLv2, SSLv3, TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3).
• Cipher Suite Support: Lists supported cipher suites and their order of preference. This is crucial for identifying weak or insecure cipher suites.
• Certificate Validation: Checks certificate validity (expiration, issuer, trust chain).
• Heartbleed Vulnerability Check: Tests for the Heartbleed vulnerability (CVE-2014-0160).
• POODLE Vulnerability Check: Tests for the POODLE vulnerability (CVE-2014-3566).
• FREAK Vulnerability Check: Tests for the FREAK vulnerability (CVE-2015-0204).
• Logjam Vulnerability Check: Tests for the Logjam vulnerability (CVE-2015-4000).
• CRIME Vulnerability Check: Tests for the CRIME vulnerability.
• Fallback SCSV Check: Checks for TLS Fallback SCSV.
• Session Resumption: Tests for session resumption support.
• HSTS (HTTP Strict Transport Security) Check: Checks for HSTS implementation.
• OCSP Stapling Check: Checks for OCSP stapling support.
• Next Protocol Negotiation (NPN) and Application-Layer Protocol Negotiation (ALPN) Check: Checks for NPN and ALPN support.
• Key Exchange Group Enumeration: Enumerates supported key exchange groups.
• And many more checks: sslyze is constantly updated with new checks for emerging vulnerabilities.

Key Features and Capabilities:

• Comprehensive SSL/TLS Analysis: Performs a wide range of tests.
• Vulnerability Detection: Identifies known SSL/TLS vulnerabilities.
• Cipher Suite Analysis: Lists and analyzes supported cipher suites.
• Certificate Information: Retrieves and displays certificate details.
• Plugin Support: Extensible through plugins.
• Command-Line Interface: Easy to use and scriptable.
• JSON Output: Can output results in JSON format for easy parsing and integration with other tools.

How to Use sslyze:

Installation: sslyze is typically installed using pip:

pip install sslyze

Basic Usage:

sslyze [options] [target ...]

Positional Arguments:

• target: The list of servers to scan. This is required and can be one or more host:port combinations.

Options:

• -h, --help: Show this help message and exit.
• --mozilla_config {modern,intermediate,old,disable}: Shortcut to run scans against Mozilla’s TLS recommendations. intermediate is the default. disable turns this off.

Trust Store Options:

• --update_trust_stores: Update the default trust stores used by SSLyze. Downloads the latest stores from GitHub. This option should be run separately from other scans.

Client Certificate Options:

• --cert CERTIFICATE_FILE: Client certificate chain filename (PEM format, sorted).
• --key KEY_FILE: Client private key filename.
• --keyform KEY_FORMAT: Client private key format (DER or PEM).
• --pass PASSPHRASE: Client private key passphrase.

Input/Output Options:

• --json_out JSON_FILE: Write results as JSON to JSON_FILE (or stdout if JSON_FILE is -).
• --targets_in TARGET_FILE: Read targets to scan from TARGET_FILE (one host:port per line).
• --quiet: Do not output anything to stdout (useful with --json_out).

Connectivity Options:

• --slow_connection: Reduce concurrent connections (for slow or overloaded servers).
• --https_tunnel PROXY_SETTINGS: Tunnel traffic through an HTTP CONNECT proxy (format: http://USER:PW@HOST:PORT/). Only Basic Authentication is supported.
• --starttls PROTOCOL: Perform a STARTTLS handshake (options: auto, smtp, xmpp, xmpp_server, pop3, imap, ftp, ldap, rdp, postgres). auto deduces the protocol from the port.
• --xmpp_to HOSTNAME: Optional setting for STARTTLS XMPP (the ‘to’ attribute of the XMPP stream).
• --sni SERVER_NAME_INDICATION: Use Server Name Indication (SNI).

Scan Commands (These are the core of what sslyze does):

• --heartbleed: Test for the Heartbleed vulnerability.
• --early_data: Test for TLS 1.3 early data support.
• --resum: Test for TLS session resumption (session IDs and tickets).
• --resum_attempts RESUM_ATTEMPTS: Number of session resumption attempts (default: 5, higher is more accurate).
• --reneg: Test for insecure TLS renegotiation.
• --robot: Test for the ROBOT vulnerability.
• --tlsv1_3: Test for TLS 1.3 support.
• --tlsv1_2: Test for TLS 1.2 support.
• --http_headers: Test for security-related HTTP headers.
• --elliptic_curves: Test for supported elliptic curves.
• --tlsv1: Test for TLS 1.0 support.
• --sslv3: Test for SSL 3.0 support.
• --sslv2: Test for SSL 2.0 support.
• --certinfo: Retrieve and analyze server certificate(s).
• --certinfo_ca_file CERTINFO_CA_FILE: CA file for certificate verification.
• --fallback: Test for TLS_FALLBACK_SCSV.
• --openssl_ccs: Test for the OpenSSL CCS Injection vulnerability.
• --tlsv1_1: Test for TLS 1.1 support.
• --compression: Test for TLS compression (CRIME vulnerability).

Examples

1. Scan a Server for SSL/TLS Configuration

sslyze example.com

👉 Runs a basic scan on example.com, checking for supported TLS versions and cipher suites.

2. Scan for Specific SSL/TLS Protocols

sslyze --tlsv1_2 --tlsv1_3 example.com

👉 Checks if TLS 1.2 and TLS 1.3 are supported on the server.

3. Detect Weak or Deprecated SSL Versions

sslyze --sslv2 --sslv3 example.com

👉 Checks whether the insecure SSLv2 and SSLv3 protocols are enabled.

4. Test for Vulnerabilities

Heartbleed

sslyze --heartbleed example.com

👉 Tests for the Heartbleed vulnerability (CVE-2014-0160).

ROBOT Attack

sslyze --robot example.com

👉 Checks for the ROBOT (Return of Bleichenbacher’s Oracle Threat) attack, which affects RSA encryption.

TLS Renegotiation

sslyze --reneg example.com

👉 Checks if insecure TLS renegotiation is enabled.

TLS Fallback Protection

sslyze --fallback example.com

👉 Tests if TLS_FALLBACK_SCSV is supported to prevent downgrade attacks.

OpenSSL CCS Injection

sslyze --openssl_ccs example.com

👉 Tests for OpenSSL CCS Injection (CVE-2014-0224), which can allow man-in-the-middle attacks.

5. Retrieve SSL Certificate Information

sslyze --certinfo example.com

👉 Fetches and displays detailed certificate information, including:

• Expiration date
• Issuer
• Chain of trust
• Signature algorithm

6. Test for TLS Session Resumption

sslyze --resum example.com

👉 Checks if session resumption (via Session IDs and Session Tickets) is supported.

7. Scan for Supported Elliptic Curves

sslyze --elliptic_curves example.com

👉 Lists the elliptic curves supported by the server for TLS key exchange.

8. Check Security-Related HTTP Headers

sslyze --http_headers example.com

👉 Identifies missing security headers such as:

• Strict-Transport-Security (HSTS)
• Content-Security-Policy (CSP)
• X-Frame-Options

9. Scan a Server Using STARTTLS (e.g., SMTP, IMAP, etc.)

sslyze --starttls=smtp mail.example.com

👉 Performs an SSL/TLS scan after STARTTLS negotiation with an SMTP mail server.

10. Save Output as JSON

sslyze --json_out=scan_results.json example.com

👉 Saves scan results in JSON format, useful for automation.

11. Scan Multiple Targets from a File

sslyze --targets_in=targets.txt

📌 Example format of targets.txt:

example.com
mail.example.com:443
192.168.1.1

👉 Scans all listed servers one by one.

12. Test Against Mozilla TLS Configuration Standards

sslyze --mozilla_config=modern example.com

👉 Checks if the server follows Mozilla’s Modern TLS security guidelines.

sslyze is a powerful and versatile tool for SSL/TLS analysis. Its comprehensive checks and JSON output make it ideal for both manual and automated security assessments. Always use it responsibly and ethically, only on systems you have permission to test. Keep sslyze updated for the latest vulnerability checks.