TLS/SSL Validation

8 tests verify TLS version enforcement and cipher suite validation (BSI IT-Grundschutz APP.3.2.A11).

Configuration

TLS settings in policy.yaml:

# policy.yaml
tls:
  # Minimum TLS version (1.2 or 1.3)
  min_version: "1.2"

  # Preferred TLS version
  preferred_version: "1.3"

  # Allowed cipher suites (TLS 1.3)
  ciphers_tls13:
    - "TLS_AES_256_GCM_SHA384"
    - "TLS_CHACHA20_POLY1305_SHA256"
    - "TLS_AES_128_GCM_SHA256"

  # Allowed cipher suites (TLS 1.2)
  ciphers_tls12:
    - "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384"
    - "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"

  # Certificate configuration
  certificate: "/etc/ssl/certs/server.crt"
  private_key: "/etc/ssl/private/server.key"

  # OCSP stapling
  ocsp_stapling: true

TLS-001PASS

TLS 1.3 connection

Test Command

openssl s_client -connect example.com:443 -tls1_3

Expected Result

Protocol  : TLSv1.3
Cipher    : TLS_AES_256_GCM_SHA384

TLS 1.3 connections are preferred. They provide improved security with simpler handshake, forward secrecy by default, and no legacy cipher suites.

TLS-002PASS

TLS 1.2 connection with modern cipher

Test Command

openssl s_client -connect example.com:443 -tls1_2 -cipher ECDHE-RSA-AES256-GCM-SHA384

Expected Result

Protocol  : TLSv1.2
Cipher    : ECDHE-RSA-AES256-GCM-SHA384

TLS 1.2 is accepted for compatibility with older clients, but only with modern AEAD cipher suites that provide authenticated encryption.

TLS-003BLOCKED

TLS 1.2 with weak cipher rejected

Test Command

openssl s_client -connect example.com:443 -tls1_2 -cipher DES-CBC3-SHA

Expected Result

error: no ciphers available

Weak cipher suites like 3DES, RC4, and non-AEAD ciphers are rejected even with TLS 1.2 connections.

TLS-005BLOCKED

TLS 1.1 rejected

Test Command

openssl s_client -connect example.com:443 -tls1_1

Expected Result

error: unsupported protocol

TLS 1.1 is deprecated (RFC 8996) and rejected. Known vulnerabilities include BEAST and lack of AEAD cipher support.

TLS-006BLOCKED

TLS 1.0 rejected

Test Command

openssl s_client -connect example.com:443 -tls1

TLS 1.0 is deprecated (RFC 8996) and rejected. Known vulnerabilities include POODLE, BEAST, and outdated cryptography.

TLS-007BLOCKED

SSL 3.0 rejected

Test Command

openssl s_client -connect example.com:443 -ssl3

SSL 3.0 is completely disabled. Vulnerable to POODLE attack and has numerous other security flaws.

Test Your TLS Configuration

Use these commands to verify TLS settings:

# Check supported protocols
nmap --script ssl-enum-ciphers -p 443 example.com

# Test specific TLS version
curl --tlsv1.3 -I https://example.com

# Full SSL test
openssl s_client -connect example.com:443 -servername example.com