Package: tlsprofiler
TLS ProfilerTheTLS Profilerclass provided in this library can be used to
compare the configuration of a TLS server to theMozilla TLS
configuration
recommendations.The Mozilla TLS recommendations are three profiles (old, intermediate, modern)
containing values for the following properties:TLS 1.3 cipher suitesTLS 1.0 - 1.2 cipher suitesProtocol versionsCertificate typesTLS curves for the key exchangeDH parameter size for the key exchangeHSTS max ageMaximum certificate lifespancipher preference (client or server choose)TLS Profileruses thesslyzelibrary under the hood. This library
retrieves a wide range of information about a TLS server remotely. For
example,sslyzecan retrieve the list of supported TLS versions.sslyzedoes not, however, rate the results (like Qualy's SSLLabs
test does) or provide information whether the server fulfills certain
criteria.TLS Profileris initialized with a domain (host) name and a target
profile name (old,intermediate, ormodern). When therun()method is called, it returns aTLS Profiler Resultwith the following
attributes:validation_errors: A list of strings describing errors that
occured while validating the certificate.certificate_warnings: A list of strings describing warnings
concerning the certificate.profile_errors: A list of strings describing deviations from the
target Mozilla profile.vulnerability_errors: Further vulnerabilities (like Heartbleet)
that can be detected bysslyze.validated: Boolean indicating whether the certificate is valid.profile_matched: Boolean indicating whether the target profile's requirements are fulfilled.vulnerable: Boolean indicating whether any vulnerabilities were discovered.all_ok: Boolean indicating whether the certificate is valid, the
profile was matched, no certificate warnings were issued and no vulnerabilities were detected.Limitations:Currently, if a server has multiple certificates only one certificate will
be recognized. This is a limitation of thesslyzelibrary (see issue#326).UsageTo use the TLS Profiler you currently need thetls_profilerbranch of the following
forks:sslyzeandnassl.API usageBasic usage of the TLS Profiler:fromtlsprofilerimportTLSProfiler,PROFILEprofiler=TLSProfiler("www.example.com")profiler.scan_server()tls_profiler_result=profiler.compare_to_profile(PROFILE.MODERN)Command-line usageHelp text for the command-line interface:usage:run.py[-h][-cCA_FILE][-wCERT_EXPIRE_WARNING]domain[profile]ScanstheTLSsettingsofaserverandcomparesthemwithaMozillaTLSprofile.

positionalarguments:domainDomainnameoftheservertobescannedprofileTheMozillaTLSprofiletoscanfor[old|intermediate|modern].Ifnoprofileisspecified,theserver'sTLSsettingswillbecomparedtoallprofiles.

optionalarguments:-h,--helpshowthishelpmessageandexit-cCA_FILE,--ca-fileCA_FILEPathtoatrustedcustomrootcertificatesinPEMformat-wCERT_EXPIRE_WARNING,--cert-expire-warningCERT_EXPIRE_WARNINGAwarningisissuedifthecertificateexpiresinlessdaysthanspecified(default15days)Exampleusage:python3run.pywww.example.comintermediateTo make the usage easier just build a docker container with
the Dockerfile in the root directory of this repository.
You have to use the following commands:docker build -t tlsprofiler .docker run tlsprofiler www.example.com intermediateTestsTo run all tests the script./tests/run_tests.shfrom the root
directory of this repository. You can call it with the argument--no-cacheto rebuild the test environment from scratch.