How do I diagnose TLS errors?
For reasons of my own, I have services on my LAN which use HTTPS and I create my own certificates for these.
Over the years, the usage of TLS has evolved considerably. Many features that were once supported are no longer considered secure, and there are many things that were once "optional" but now are required by most software.
Browsers are maddeningly unhelpful here. When something is wrong with the certificate, I get a very opaque "You're getting hacked!" style message. If I am lucky I can sometimes dig up an error code buried somewhere. But it's very hard to take this error code and figure out what exactly I'm doing wrong when generating the cert. A search for a browser TLS error code is inevitably cluttered with user advice about things like asking your sysadmin or checking if your modem is unplugged. 🙄
Is there a way that I can check my server's certificate and figure out exactly what does not conform to current best practice? This would have to be a client side program. I've seen some websites where you plug in a hostname and they check the TLS for you, but my server is on LAN only and won't be accessible for those, and in any case they won't have my CA installed.
1 answer
Over some period of time, I have used a couple tools for local TLS scans and diagnostics. One of them may include pointers for whatever situation you have.
| Tool | Description | From | Current? |
|---|---|---|---|
sslyze |
TLS analysis by protocol | ✓ | |
cipherscan |
TLS analysis by cipher. Slightly clunky. | Mozilla | ✗ |
pshtt |
HTTPS + HSTS analysis, old sslyze
|
CISA | ✗ |
sslyze works fantastic if you just want to scan periodically for broken certificate chains, weak cryptography, and whether your server(s) are vulnerable to the exploit du jour.[1]
If you also want some HTTP analysis, you can rig an old Python[2] to also scan with pshtt.
-
Poodle, Heartbleed, Robot, etc. ↩︎
-
The issue section for
pshttincludes several comments asking why CISA doesn't support recent Python versions. ↩︎
0 comment threads
1 comment thread