Hacker News Reader

Comment by Twirrim | Hacker News Reader

Also useful. sslscan (http://sourceforge.net/projects/sslscan/). Point it to an endpoint and it will tell you all the ciphers and protocols that are accepted, and what the various defaults are, and details about the certificate bound to it. It's available in the Debian/Ubuntu repository for easy installation.

View on HN

SSL Scan is good, but the industry standard for server configuration scanning is SSL Labs:

https://www.ssllabs.com/index.htm

How would you go about testing your internal endpoints?

Use Nmap's SSL scripts. Especially useful for scanning STARTTLS non-web services like SMTP, POP3, and IMAP.

Agreed, but not everything is public facing, and sometimes you need quick verification. ssllabs is great and should definitely be done on all external endpoints, but it takes a while to run.

Would being able to specify a HTTP (CONNECT) proxy to SSL Labs be useful to you for the testing of your internal hosts?

Being able to use non standard ports would help. I usually just SSH tunnel it in. But needing to use port 443 makes it annoying.

So, two things.

First, the link is missing an 'l' at the end. [0] Second, exactly what makes SSL Labs the 'industry standard'? I'm well-aware of their services and use in the industry, but I would tend to think that the actual RFCs are industry standard, and not a rather specious high-school grading system for whether a particular TLS provider is secure.

[0] https://www.ssllabs.com/index.html

In my opinion, the high-school grading system is one of the best features of SSL Labs. Most people don't have the time or interest to read the RFCs and follow the issues closely. The grading system help them easily understand what is important and what isn't. (Disclosure: I built SSL Labs.)

So I used this site to check my server and then used the Mozilla SSL config generator. This fixed my site and got me to an "A" rating.

So at this point the biggest thing I'm looking at is the "Chain issues" line that reads "Contains anchor". Assuming this has something to do with the bundle file I created?

Yes. Your bundle should not actually contain the top-level CA certificate which is present in browsers.

Thanks, that did the trick.

Reply on news.ycombinator.com