6 ms·
Quick online tool to check SSL configurations
- alexchamberlain 15y agoWell made tool that provides some good information backed by solid evidence.
- GvS 15y agoThanks, nice tool! It told me that my server is vulnerable to some kind of BEAST attack. I searched a bit about that and fixed it.
- nodata 15y agoAlso https://www.wormly.com/test_ssl https://www.wormly.com/test_ssl
- darklajid 15y agoSame problem for me: SNI seems to be broken, it always falls back to my default cert.
- pud 15y agoNeat tool. If anyone wants to see what a broken SSL certificate looks like, here's one of my expired ones (I really gotta renew it one of these days...) https://www.ssllabs.com/ssldb/analyze.html?d=https://secure.tweetname.com https://www.ssllabs.com/ssldb/analyze.html?d=https://secure....
- there 15y agoShameless plug: my free site http://domainical.org/ http://domainical.org/ will build an auto-updating calendar of domain and SSL certificate expirations that you can subscribe to in iCal, Google Calendar, etc. (assuming you just forgot to renew that cert)
- darklajid 15y agoWhile I liked the opportunity to tweak my configuration: A tool that doesn't support SNI (at least it complains about getting the wrong certificate for one of my domains, something that doesn't happen in any browser I tested) is - restricted.
- jackalope 15y agoWhat kind of error do you get? It's probably related to the certificate that gets served when it makes a request to the bare IP address without a Host: header. In most cases, that's only going to match one or two of the domains you enter, unless you're using a wildcard certificate or one that includes all the DNS alternative names. Did it affect your score much?
- ivanr 15y ago[Note: I am the author of the tool.] Yes, it's somewhat restricted without SNI support. I wrote the tool back in 2009 when having SNI was not very useful (because there was virtually no support for it). Sadly, the situation has not improved much since. Had you tested with Internet Explorer running on Windows XP (which is what a huge chunk of the Internet population still runs), you will have found that SNI simply does not work there. That fact alone rules out SNI for web sites that have general audience as target. Anyhow, a big update is planned for later this year. The Rating Guide, which determines the score, will be revised, the tool itself will be tweaked to become more actionable and include more documentation, and a number of very useful advanced features will be added. I expect we will also start showing historical information, as well as start tracking all public SSL sites. Also, in two weeks' time we will be releasing an SSL/TLS Deployment Best Practices guide to help people configure their web sites correctly.
- mike-cardwell 15y agoI just wanted to take an opportunity to thank you for building this brilliant tool. I have used it many times and recommend it to people all the time. It's a brilliant way of demonstrating to non-techies that there is an actual problem with their server configuration.
- ck2 15y agoIt refuses to check the quality of shared SSL certs.
- jerhewet 15y agoNice blogpost regarding BEAST on IIS servers: http://blogs.msdn.com/b/kaushal/archive/2011/10/03/taming-the-beast-browser-exploit-against-ssl-tls.aspx http://blogs.msdn.com/b/kaushal/archive/2011/10/03/taming-th...
- preinheimer 15y agoIf you're running apache this line helped me improved my score drastically: SSLCipherSuite ALL:!ADH:!EXPORT56:!EXPORT40:RC4+RSA:+HIGH:+MEDIUM:-LOW:-SSLv2:+EXP:+eNULL
- emmelaich 15y agoWhy include EXP or eNULL at all?
- fduran 15y agoThis is great although I'm not sure I agree with showing a list of "Recent Worst-Rated" (graded "F", presumed with vulnerabilities), seems like painting a target on some servers.