1

I want to do automated SSL server testing. Like what Qualys, Inc is offering with SSL Server Test but running fully automated in a build environment like TeamCity or Jenkins.

Does anybody know tools/services for this purpose?

3

The first thing that comes to my mind is sslyze.

https://github.com/nabla-c0d3/sslyze

I use it for penetration testing, in the event that I can't use online SSL-tests like https://www.ssllabs.com/ssltest/index.html, because the test-site can only be reached over a proxy server.

It has a GPLv2-license and the source code can be downloaded from above link. So you should be able to use it for your projects.

It is a library that runs on Python, and I think it's very easy to use.

1

I have found another option: Qualys, Inc SSL Labs API. Libraries and command-line tools are available for Java, .Net, Python and more.

https://www.ssllabs.com/projects/ssllabs-apis/index.html

The terms of use permit users to test their own servers.

1

Both options provided already are quite good and will net you a good amount of information.

However, there is also another option to test that should be built into any system with OpenSSL installed (most easily executed from your favorite Linux flavor), which I assume a Jenkins install is on. OpenSSL has a tool called s_client which can net you quite a bit of information.

To use it, simply invoke it like so:

openssl s_client -connect www.mywebsite.com:443

-connect will also allow you to use an IP (e.g. 10.20.30.40:443) and you can also force usage of specific ciphers, cert files or key, CAs, etc should you need to test those. This wiki page should help get you going on other options as well: OpenSSL s_client Wiki

edit: Forgot to add that wrapping this with a tool like "timeout" from the coreutils package can help with automation. When attempting to establish a connection, it may take quite a while before it fully "fails" or can't negotiate properly. So doing something like this will time out at the 3 second mark and give you what it has:

timeout 3 openssl s_client -connect www.mywebsite.com:443

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.