SSL Decoder
Security and privacy
ssl tls testing
SHOW HN2015
How HN took it
9 positive, 6 neutral or asking, 1 mixed, 4 critical, out of 20 comments about the project. Thread score +0.20.
Execution: 0 for, 4 againstIdea: 3 for, 0 againstDesign: 2 for, 0 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Open source alternative to SSL Labs
From 2 comments
Nice work. This will help a lot of people who audit sites.. and its great to have an open alternative to the closed source ssllabs tester.
eyeareque on HNThank you for putting this all together and making it open source. By the way, will you be releasing an API? I think this API would be really valuable.
humanarity on HN
Clean design with clear health check marks
From 1 comment
I really like the nice big horizontal check marks for the "health" of each aspect of the certificates. Thank you for releasing this.
billyhoffman on HN
Short domain name and useful tool
From 2 comments
This is pretty great (and you even managed to snag a short domain name)! For those who are trying to use the command line (rather than a webapp), "sslscan" performs these checks…
david_shaw on HNThanks. Just needed something like this last week.
cookiecaper on HN
Objections
Does not check SSLv2 or older protocol negotiation
From 2 comments
Thanks, looks great! I'd like to see a check for SSLv2. For instance this site supports sslv2 and it should be flagged: download.biscom.com.…
abarringer on HNFeature/bug: It doesn't seem to attempt to explicitly negotiate older protocols. For instance, I'm dealing with a site that still has SSLv2 and export ciphers enabled if a client…
MichaelGG on HN
Does not detect IPv6 on dual-stacked hosts
From 1 comment
If your hostname is dual stacked it only checks for ipv4 afaik.
simon_vetter on HN
Flags 3DES ciphers and RC4 which users cannot easily change on load balancers
From 2 comments
These services always dock me for including RC4 ciphers. I understand that these are bad because RC4 is broken or near broken; I shouldn't be using it. However, I'm simply using…
deathanatos on HNI've tweaked my Apache configuration but don't seem to be able to trigger a rescan--the cipher list doesn't appear to change. I guess it's cached for a little while, but the UI…
yrro on HN
Serial numbers highlighted in red look like errors
From 2 comments
Why are certificate serials highlighted in red?
gkoz on HNMaybe he meant that coloring them red means that something went wrong or that there's something that you should pay attention to. Of course I'm just speculating here.
saganus on HN
Requests
API for results
From 1 comment
Thank you for putting this all together and making it open source. By the way, will you be releasing an API? I think this API would be really valuable.
humanarity on HN
IPv6 support
From 1 comment
Thanks for doing this, awesome job. May I request IPv6 support?
simon_vetter on HN
SSLv2 detection
From 1 comment
Thanks, looks great! I'd like to see a check for SSLv2. For instance this site supports sslv2 and it should be flagged: download.biscom.com.…
abarringer on HN
Summary of concerns at top of report
From 1 comment
Nice. Friendly suggestion: Show a prominent summary at the top of the report of any areas of concern.
Silhouette on HN
ChaCha20 enumeration and BoringSSL detection
From 1 comment
Few notes: - Does not enumerate ChaCha20 - Doesn't detect BoringSSL - try running it on certly.io
iancarroll on HN
Questions
How does it determine the destination SSL library?
From 1 comment
Nice work. How do you determine the destination SSL library?
smy1es on HN
Can results be rescanned after config changes?
From 1 comment
I've tweaked my Apache configuration but don't seem to be able to trigger a rescan--the cipher list doesn't appear to change. I guess it's cached for a little while, but the UI…
yrro on HN
Alternatives named
sslscan command line tool
From 2 comments
This is pretty great (and you even managed to snag a short domain name)! For those who are trying to use the command line (rather than a webapp), "sslscan" performs these checks…
david_shaw on HN+1 to SSLScan. Last time I checked though, the Windows builds don't work/support the XML output option. Automating this last year involved capturing STDOUT and regexing...
billyhoffman on HN
SSL Labs server test
From 2 comments
Thanks, looks great! I'd like to see a check for SSLv2. For instance this site supports sslv2 and it should be flagged: download.biscom.com.…
abarringer on HNNice work. This will help a lot of people who audit sites.. and its great to have an open alternative to the closed source ssllabs tester.
eyeareque on HN
ssltest by jamescun
From 1 comment
I started to build a similar thing, for the command line, last year but did not get as far. https://github.com/jamescun/ssltest
jamescun on HN