Hacker News Reader

Comment by dan1234 | Hacker News Reader

What features did SSLPing have that forced it to rely so heavily on old versions of OpenSSL?

From https://web.archive.org/web/20220328120435/https://sslping.c...

> SSLPing needs less than 5 seconds to check your server and tell you what's wrong with your SSL/TLS security.

So I guess it used OpenSSL to figure out what was wrong with people's certificates. Not sure what it used that relied on internals so heavily it was hard to upgrade, or if the public interface just changed a lot.

Even with that, seems there was multiple issues that "prevented" ("made it harder than justifiable" rather) the author from keeping the project up, not just regarding OpenSSL.

Ah ok, so it sounds like an automated (though probably cutdown) version of the SSLLabs server test.

It does a little more and little less.

More: Enter a list of (sub-) domains and get informed via email when "SSL things" change (for better or for worst), or your https certificate is about to expire.

Less: No fancy pansy "report"

Personally I prefer https://hardenize.com nowadays, over ssllabs for these kind of queries.

https://hardenize.com is quite pretty, but there's nowhere near $999/mo of value in it for me!

Hardenize's paid plan is intended for larger businesses, where we combine infrastructure discovery with continuous monitoring and many other things. However, ad-hoc assessments are free for everyone and we intend to keep it that way. I hope that we will in time be able to provide plans at lower price points and maybe a free plan at some point.

(Hardenize founder, previously also SSL Labs founder.)

My guess: SSLv3 has been dropped from OpenSSL, which means hitting a SSLv3 server just fails to connect quite early in the process, so there would not even be cert reading, plus IIRC the connection error can be very obtuse, which means sslping could not do that:

> tell you what's wrong

SSLping creator here...

Actually node.js is using openssl under the hood... SSLPing implemented a partial SSL implementation to quickly test support for SSL versions and cyphers, but used node.js native libs too. Newer node.js versions weren't able to get an SSL certificate out of a SSL v3 only server, for instance. Which didn't allow to test for expiration, etc...

But yes, there were multiple issues indeed

Speculation ahead:

It didn't just check if a certificate is valid now, but whether the certificate, intermediary, CA (or anything in the chain) is about to expire soon.

It might have needed to poke deeper into OpenSSL than regular uses.

You don’t need anything peculiar in OpenSSL to do that. I’ve been monitoring my ssl certs with a simple nodejs script (it just connects to get the cert details so generally less than a second per domain).

Perhaps their service also tested for deprecated ciphers/tls versions?

it did test supported cyphers and SSL versions, common vulnerabilities, etc... (SSLPing creator here)

It's also blocked by AdGuard.

Yeah I was trying to figure out what was going on here. Is it blocked cos it's closing or was it blocked from before?

SSLPing was a tool that was designed to test SSL/TLS/PKI server configuration. According to the author's message, it was built on top of OpenSSL. There have been significant changes made to OpenSSL since 2016, many focused on improving security by removing very old cryptographic primitives that are obsolete and insecure. Think RC4, 3DES, SHA1, and so on. If you're relying on OpenSSL to detect presence of such primitives on a server, upgrading your own (client) OpenSSL version breaks the functionality.

This is a problem for all testing tools that rely on OpenSSL. If you follow this direction, you typically need to use at least two OpenSSL versions, one new to test modern features and one very old to test obsolete features.

Hi Ivan,

I know you appreciate the issue to its fullest like no one else! Cheers

Reply on news.ycombinator.com