-
-
Notifications
You must be signed in to change notification settings - Fork 85
/
Copy pathhelp.txt
5306 lines (3651 loc) · 187 KB
/
help.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
# SID @(#) help.txt 3.40 25/02/01 10:39:44
NAME
O-Saft - OWASP SSL advanced forensic tool
OWASP SSL audit for testers
SYNOPSIS
$0 [COMMANDS ..] [OPTIONS ..] target [target target ...]
where [COMMANDS] and [OPTIONS] are described below and target is
a hostname either as full qualified domain name or an IP address.
Multiple commands and targets may be combined.
All commands and options can also be specified in a rc-file, see
RC-FILE below.
I.g. all commands start with a '+' character and options start with
'-' or '--' characters. Anything else is treated as target name.
Arguments (commands, options and targets) can be used in any order.
If options are given multiple times, or when they configure the same
behaviour (for example toggles like --tlsv2 and --no-tlsv2), the last
given one wins.
Arguments are read from following sources in that sequence:
1. rc-file if not disabled with --no-rc
for details, please see section RC-FILE below
2. environment variable OSAFT_OPTIONS
3. command-line
DESCRIPTION
This tool lists information about remote target's SSL certificate,
and tests the remote target according given list of ciphers.
Note: Throughout this description `$0' is used as an alias for the
program name 'o-saft.pl'.
QUICKSTART
Before going into a detailed description of the purpose and usage,
here are some examples of the most common use cases:
* Show supported (enabled) ciphers of target:
$0 +cipher --enabled example.tld
* Show details of certificate and connection of target:
$0 +info example.tld
* Check certificate, ciphers and SSL connection of target:
$0 +check example.tld
* Check connection to target for vulnerabilities:
$0 +vulns example.tld
* Get the certificate's Common Name for a bunch of servers:
$0 +cn example.tld some.tld other.tld
* List more usage examples
$0 --help=examples
* List all available commands:
$0 --help=commands
* Get table of contents for complete help
$0 --help=toc
* Show just one section, for example SECURITY, from help
$0 --help=SECURITY
* Show all --help=* commands
$0 --help=HELP
* Search for text in O-Saft's help and show with context
o-saft --help=your-text
* Start the simple GUI
o-saft.tcl
# above o-saft.tcl must have trailing space, otherwise markup fails
* Start the simple GUI which uses $0 in a Docker image
o-saft.tcl --docker
For more specialised test cases, refer to the sections COMMANDS and
OPTIONS below. For more examples please refer to EXAMPLES section.
For more details, please see X&Requirements& and INSTALLATION below.
WHY?
Why a new tool for checking SSL security and configuration when there
are already a dozen or more such good tools in existence (in 2012)?
Unique features:
* working in closed environments, i.e. without internet connection
* checking availability of ciphers independent of installed library
* checking for all possible ciphers (up to 65535 per SSL protocol)
* mainly same results on all platforms.
Currently available tools suffer from some or all of following issues:
* lack of tests of unusual SSL certificate configurations
* may return different results for the same checks on given target
* missing tests for modern SSL/TLS functionality
* missing tests for specific, known SSL/TLS vulnerabilities
* no support for newer, advanced, features e.g. CRL, OCSP, EV
* limited capability to create your own customised tests
Other reasons or problems are that other tools are either binary or
use additional binaries and hence are not portable to other platforms.
In contrast to (all?) most other tools, including openssl(1), it can
be used to "ask simple questions" like "does target support STS" just
by calling:
$0 +hsts_sts example.tld
For more, please see EXAMPLES section below.
If it should run on systems with old software (perl or Perl modules),
please see DEBUG section below.
SECURITY
This tool is designed to be used by people doing security or forensic
analyses. Hence no malicious input is expected.
There are no special security checks implemented. Some parameters are
roughly sanitised according unwanted characters. In particular there
are no checks according any kind of code injection.
Care should be taken, when additional tools and modules are installed
as described in INSTALLATION below. In particular it is recommended
to do these installations into directoies specially prepared for use
with $0 .
No other tools of your system should use these additional installed
tools, for example by accident or because environment variables point
to them.
Note that compilation and installation of additional tools (openssl,
Net::SSLeay, etc.) uses known insecure configurations and features!
This is essential to make $0 able to check for such insecurities.
It is highly recommended to do these installations and use the tools
on a separate testing system.
DO NOT USE THESE INSTALLATIONS ON PRODUCTIVE SYSTEMS.
CONCEPTS
The purpose of O-Saft is to do the work, not to force the user to
learn a new tool or to install "newer" software first.
However, the user "should do something" if necessary depending on the
reported results.
Developers may read more details on the concept in doc/concepts.txt.
This help text
The sequence of the sections in the help text doesn't strictly follow
the common guidlines for UNIX-style man pages. This is because it is
important to understand the concepts of the tool and what options and
commands are in context of the tool. In particular the DESCRIPTION
section contains only a very brief description. The OPTIONS section
follows the COMMANDS section.
Results
Results of SSL/TLS security tests of this tool are of these types:
* cipher suite names with a security qualification
* checks with a value of 'yes' or 'no'
* information with various random texts
These results are grouped and provided with a propper headline. Some-
times some summary lines are also printed.
Results of checks are marked 'yes' or 'no'. This leaves the proper
interpretation, if the result is "good" or "bad", to the user.
Background: it is not always possible to rate a result as "good" or
"bad" or "insecure" or whatever. That's why O-Saft can not give the
"the best" or "proper" recommendation. In practice it depends on the
context what a recommendation or countermeasure should be. That's why
results are marked 'yes' or 'no' if considered "questionable", or
"not good" (for example according other checks).
For more details please see RESULTS below.
TECHNICAL INFORMATION
It is important to understand, which provided information is based on
data returned by underlaying (used) libraries and the information
computed directly.
Version 23.11.23 and later
Starting with version 23.11.23 all checks for ciphers are done by our
own plain Perl code, just the SSL/TLS-related checks and informations
use Net::SSLeay(3pm) and openssl.
Since version 23.12.23 OpenSSL 3.0.x is supported also.
Beside new and removed funtionality in OpenSSL (details see below),
OpenSSL also changed some texts in its responses. Again this makes it
hard to parse openssl's output properly. Therfore scanning for cipher
is now done without openssl. Using openssl to scan must be requested
explicitly with the --ciphermode=openssl option.
Keep in mind that it is not possible to check if the target supports
ancient ciphers with openssl 3.x. There even does not exist a patched
version, as we used before, to do it. However, any openssl 1.x can be
be used if specified with the --openssl=/path/to/openssl option.
Following changes in OpenSSL have been observed (incomplete list):
# our command/option| OpenSSL 1.x | OpenSSL 3.0.x
#-------------------+-----------------------+---------------------
-ssl2 -no_ssl2 | -ssl2 -no_ssl2 | <<not supported>>
-ssl3 -no_ssl3 | -ssl3 -no_ssl3 | <<not supported>>
-tls1_3 -no_tls1_3 | <<not supported>> | -tls1_3 -no_tls1_3
-dtls1 -dtls1_2 | <<not supported>> | -dtls1 -dtls1_2
| <<not supported>> | -legacy_renegotiation
| <<not supported>> | -prioritize_chacha
+resumption_psk | <<not supported>> | Resumption PSK: ...
+selfsigned | self signed | num=18:self-signed
+sslversion | TLSv1.2 | TLSv12
+renegotiation | renegotiation info" (id=65281), len=1
| Secure Renegotiation IS NOT supported
+sigkey_len | 2048 | 2104
+sigkey_value | hexhex | Signature Value hexhex
+dh_parameter | ECDH, P-256, 256 bits | X25519, 253 bits
+cipher-selected | New, TLSv1/SSLv3, ... | New, TLSv1.3, ...
-nextprotoneg -npn | -nextprotoneg | not allowed for TLSv1.3
#-------------------+-----------------------+---------------------
As the purpose of this tool is to check for any cipher, wether known
or not, using modern OpenSSL 3.x is not feasible because it is simply
not possible. This restriction may apply to other tools which rely on
openssl or the underlying libssl too.
The default configurations are build for detecting any known issues. It may
This may result in warning messages when tools are used which miss
proper funtionality (for example in OpenSSL 3.x).
Beyond this limitation, checking old protocols and ciphers on targets
which use modern libraries, may result in a bunch of warnings. If it
happens, following can be done to get a better overview:
$0 target --header +cipher
$0 target --header +cipher --nossl2 --nossl3 --notls1
$0 target --header +cipher --no-warnings
$0 target --header +cipher --nossl2 --nossl3 --notls1 --no-warnings
$0 target --header +cipher --ciphermode=openssl --openssl=/path/openssl
$0 target --header +cipher --ciphermode=openssl --notls --tlsv13 --no-npn
As workaround to get rid of a warning the option --ignore-warning=NNN
can be used, for example:
--ignore-warning=150
Version 19.11.19 and later
Starting with version 19.11.19 the +cipher command does not use any
external library. Checking for ciphers is done using plain Perl code.
Only other collected SSL/TLS related information requires an external
library, in general libssl.
The description about OpenSSL and libssl below applies only if any of
the options --ciphermode=openssl or --ciphermode=socket are given
with the +cipher command.
Therefore following commands and options changed:
# Version < 19.11.19 | change ...
#--------------------------+---------------------------------
* +cipher | uses internal method
* +cipherall | command obsolete, !!Hint is printed
* +cipherraw | command obsolete, !!Hint is printed
* --force-openssl |
* --openssl-ciphers | changed to --ciphermode=openssl
* --openssl=TOOL | TOOL only used for +cipher --ciphermode=openssl
* --legacy=owasp | option obsolete
#--------------------------+---------------------------------
The historic commands +cipherall and +cipherraw should be replaced
with the new syntax, as follows:
# Version < 19.11.19 | Version > 19.11.19
#--------------------------+---------------------------------
* +cipher | +cipher --ciphermode=socket
* +cipher --force-openssl | +cipher --ciphermode=openssl
* +cipherall | +cipher
* +cipherraw | +cipher --ciphermode=intern
#--------------------------+---------------------------------
Version before 19.11.19
Up to version 19.11.19 the default behaviour for the +cipher command
was to use libssl. The commands +cipherall and +cipherraw did not
use any other library as described below.
Testing for ciphers
The default mode of the tool is to check ciphers with a simple socket
connection providing the minimal required data for SSL/TLS. It allows
testing for any cipher independent of any other tool installed on the
system.
For more details on testing ciphers, please see section SSL ciphers
in CHECKS below.
OpenSSL, libssl, libcrypto
In general the tool uses Perl's Net::SSLeay(3pm) module which itself
is based on libssl and/or libssleay library of the operating system.
It's possible to use other versions of these libraries, see options:
* --exe-path=PATH --exe=PATH
* --lib-path=PATH --lib=PATH
* --envlibvar=NAME
The external openssl(1) is called to extract some information from
its output. The version of openssl can be controlled with following
options:
* --openssl=TOOL
* --no-openssl
* --ciphermode=openssl
* --exe-path=PATH --exe=PATH
* --openssl-cnf=PATH
* --openssl-s_client --s_client
OpenSSL is recommended to be used for libssl and libcrypto. Versions
0.9.8k to 1.0.2e (Jan. 2016) are known to work. However, versions be-
for 1.0.0 may not provide all information.
Some functionality (checks) of O-Saft may be missing or fail, when
openssl versions 1.1.x are used (because functionality was removed).
LibreSSL is not recommended, because some functionality considered
insecure, has been removed.
For more details, please see INSTALLATION below.
Certificates and CA
All checks according the validity of the certificate chain are based
on the root CAs installed on the system. Note that Net::SSLeay(3pm)
and openssl(1) may have their own rules where to find the root CAs.
Please refer to the documentation on your system for these tools.
However, there are folloing options to tweak these rules:
* --ca-file=FILE
* --ca-path=DIR
* --ca-depth=INT
Commands and options
All arguments starting with '+' are considered COMMANDS for this
tool. All arguments starting with '--' are considered OPTIONS for
this tool.
Reading any data from STDIN or here-documents is not yet supported.
It's reserved for future use.
Environment variables
Please see ENVIRONMENT .
Requirements
For +info and +check (and all related) commands, perl (5.x) with
following modules (minimal version) is recommended:
* IO 1.25 (2011)
* IO::Socket::INET 1.37 (2011)
* IO::Socket::SSL 1.90 (2013)
* Net::DNS 0.66 (2011)
* Net::SSLeay 1.49 (2012)
However, it is recommended to use the most recent version of the mod-
ules which then gives more accurate results and less warnings. If the
modules are missing, they can be installed for example with:
cpan Net::SSLeay
Note: if you want to use advanced features of openssl or Net::SSLeay,
please see INSTALLATION section how to compile and install the tools
fully customised. Requirements for OpenSSL are described there.
Also an openssl executable should be available, but is not mandatory.
For checking DH parameters of ciphers, openssl 1.0.2 or newer should
be available. If an older version of openssl is found, we try hard to
extract the DH parameters from the data returned by the server, see
+cipher-dh command.
If you need to run on systems with older perl or Perl module versions
please refer to the DEBUG section for more information.
External tools
For building and/or viewing the documentation, any of following tools
should be available:
* aha 0.5-1
* perldoc v3.2801
* pod2man
* pod2usage
* podviewer v0.18
* tkpod
* tput
* stty
COMMANDS
There are commands for various tests according the SSL connection to
the target, the targets certificate and the used ciphers.
All commands are prepended by a '+' character to easily distinguish
from other arguments and options. However, some --OPTIONS options are
treated as commands for historical reason or compatibility with other
programs.
The most important commands are (in alphabetical order):
+check +cipher +info +http +list +quick +sni +sni_check +version
A brief list of all available commands will be printed with:
$0 --help=cmd
The description of all other commands will be printed with:
$0 --header --help=commands
The summary and internal commands return requested information or the
results of checks. These are described below.
Note that some commands may be a combination of other commands, see:
$0 --header --help=intern
The following sub-sections only describe the commands, which do more
than giving a simple information from the target. All other commands
can be listed with:
$0 --header --help=commands
The final sub-sections X&Notes about commands& describes some notes
about special commands and related commands.
Commands for information about this tool
All these commands will exit after execution (cannot be used together
with other commands).
+ciphers
Show known ciphers in format like "openssl ciphers".
It also accepts the -v and -V option (like openssl).
Use +list command for more information according ciphers.
+list
Show all ciphers supported by this tool. This includes cryptogrphic
details of the cipher and some internal details.
Different output formats are used for the --legacy=* option:
* --legacy=simple - simple space-separated output
* --legacy=full - TAB-separated output with more data
* --legacy=owasp - simple output sorted according OWASP scoring
* --legacy=openssl - output same as with +ciphers command
* --legacy=ssltest - output like "ssltest --list"
# Use --v option to show more details.
# seit 15.01.07 nicht mehr benutzt
+VERSION
Just show version and exit.
+version
Show version information for both the program and the Perl modules
that it uses, then exit.
Use --v option to show more details.
+libversion
Show version of openssl.
+quit
Show internal data and exit, used for testing and debugging only.
Please see TESTING below.
Commands to check SSL details
#
# Check for SSL connection in SNI mode and if given FQDN matches
# certificate's subject.
Following (summary and internal) commands are simply a shortcut for a
list of other commands. For details of the list use:
$0 --help=intern
+check
Check the SSL connection for security issues. Implies +cipher .
+host
Print details about the targets hostname, DNS, etc.
These details are usually printed only for the +check and +info
command, but not for any individual command.
+http
Perform HTTP checks (like STS, redirects etc.).
+info
Overview of most important details of the SSL connection.
Use --v option to show details also, which span multiple lines.
#
# 24.01.24: funktionier jetzt ähnlich wie +quick, neue Beschreibung nötig:
# +info--v
#
# Overview of all details of the SSL connection. It is a shortcut for
# all commands listed below but not including +cipher.
#
# This command is intended for debugging as it prints some details of
# the used lib/SSLinfo module.
+quick
Quick overview of checks. Implies --enabled and --label=short.
+pfs
Check if servers offers ciphers with prefect forward secrecy (PFS).
Same as: +cipher-pfs +cipher-pfsall +session_random
+protocols
Check for protocols supported by target.
+vulns
Check for various vulnerabilities.
+sts
+hsts
Various checks according STS HTTP header.
This option implies --http, means that --no-http is ignored.
+sni
Check for Server Name Indication (SNI) usage.
+sni_check
+check_sni
Check for Server Name Indication (SNI) usage and validity of all
names (CN, subjectAltName, FQDN, etc.).
+bsi
Various checks according BSI TR-02102-2 and TR-03116-4 compliance.
+ev
Various checks according certificate's extended Validation (EV).
Hint: use option --v --v to get information about failed checks.
+sizes
Check length, size and count of some values in the certificate.
+s_client
Dump data retrieved from "openssl s_client ..." call. This should
be used for debugging only.
It can be used just like openssl itself, for example:
openssl s_client -connect host:443 -no_sslv2
+dump
Dumps internal data for SSL connection and target certificate. This
is mainly for debugging and should not be used together with other
commands (except +cipher).
Each key-value pair is enclosed in '#{' and '#}' .
Using --trace --trace dumps data of lib/SSLinfo too.
+exec
Command used internally when requested to use other libraries.
This command should not be used directly.
Commands to test ciphers provided by target
Beside the description of the commands itself here, please see also
X&Notes about commands& below.
+cipher
Check target for ciphers, either all ciphers, or ciphers specified
with --cipher=CIPHER option.
Use --v option to see all ciphers being checked.
+cipher-default
Lists the cipher selected by the server for each protocol sometimes
referred to as "default cipher".
For each protocol the two selected ciphers are shown, one returned
by the server if the cipher list in the ClientHello is sorted with
the strongest cipher first, and one returned if the cipher list in
the ClientHello is sorted with strongest cipher last.
See X&Notes about commands& for details.
+cipher-dh
Checked target for ciphers. All ciphers supported by the server are
printed with their DH or ECDH paramaters (if available).
ciphers.
+null
+cipher-null
Check if target accepts NULL ciphers.
+adh
+cipher-adh
Check if target accepts ciphers with anonymous key exchange.
+export
+cipher-exp
Check if target accepts EXPORT ciphers.
+cbc
+cipher-cbc
Check if target accepts CBC ciphers.
+des
+cipher-des
Check if target accepts DES ciphers.
+rc4
+cipher-rc4
Check if target accepts RC4 ciphers.
+edh
+cipher-edh
Check if target supports ephemeral ciphers.
+cipher-pfs
Check if target supports ciphers with PFS.
+cipher-strong
Check if target selects strongest cipher.
+cipher-weak
Check if target selects weak cipher (oposite of +cipher-strong).
# next 4 lines will be replaced by o-saft-man.pl, see /Discrete commands/ there
Discrete commands to test SSL connection and certificate details
Discrete commands, please see:
$0 --help=commands
Notes about commands
+cipher vs. +cipher-dh
While +cipher prints checked ciphers, +cipher-dh prints ciphers
with their DH or ECDH paramaters (if available) only for supported
ciphers.
+cipher vs. +cipher-default
Both commands show the default cipher foreach protocol.
+cipher lists a summary of ciphers selected by the server for each
protocol requested by the user (for example by using options like:
--sslv3 --tlsv1 etc.). When the --v option is used, all selected
ciphers for all known protocols are listed. This summary focuses on
counts for various ciphers.
+cipher-default lists the cipher selected by the server for each
protocol.
+cipher-selected vs. +cipher-default
+selected lists the cipher selected by the server if no particular
protocol was specified and the system's default cipher list is send
in the ClientHello to the server.
+cipher-default lists the cipher selected by the server for each
protocol.
# other names: SSLHonorCipherOrder prefer-server-ciphers PreferServerCipherSuites Server-Defined-Cipher-Order
+cipher-strong vs. +cipher-default
+strong-cipher shows the result of the check if strong ciphers are
preferred by the server. It is a check command.
+cipher-default lists the cipher selected by the server for each
protocol. It is a information command.
It is not possible to check if a server uses 'SSLHonorCipherOrder'.
Even if it is used (switched on), it is not possible to check the
specified order of the ciphers.
I. g. it is expected that the order is according the cipher suite's
strength, meaning the most strongest first, and the weakest last.
It doesn't make sense to use an order where a weak cipher preceds a
stronger one. Such a (mis-)configuration should be detected.
Having this in mind, the algorithm to detect a proper cipher order
is as simply as follows:
1. pass sorted cipher list with strongest cipher first
2. pass sorted cipher list with strongest cipher last
if the server returns the same cipher for both checks, it's assumed
that it prefers to use the most strongest cipher. In this case it's
obvious that 'SSLHonorCipherOrder' is set (exceptions see below).
Exceptions:
If either, the server or the client, uses only one cipher suite in
the list, SSLHonorCipherOrder cannot be detected at all.
The same happens, if only one cipher in the client's list matches a
cipher in the server's list.
+tlsextdebug
+tlsextensions
+extensions vs. +tlsextensions
"Certificate extensions" are shown with +extensions while the TLS
protocol extensions are shown with +tlsextensions.
Use +tlsextdebug to show more information about the TLS protocol
extensions.
+http2 +spdy +spdy3 +spdy31 +spdy4 +prots
These commands are just an alias for the +protocols command.
+wildcard
+hostname vs. +wildhost vs. +altname vs. +rfc_2818
The commands +cn and +altname print the information stored in
the certificate.
The command +hostname checks if the given hostname matches the CN
value in the certificate. Note that wildcard names in the CN, only
allow to contain one '*'.
The command +wildcard checks if the given hostname does not match
any name specified in the certificate's "subjectAltname". This check
is useful if the certificate and the configuration must comply to
RFC 6125 or EV certificates.
OPTIONS
All options are written in lowercase. Words written in all capital in
the description here is text provided by the user.
Options for help and documentation
--h
Brief documentation of --help* options/commands.
--help
Complete user documentation.
# next line to keep generated HTML links happy
--help*
--help=cmd
Show a brief list of all available commands.
--help=commands
Show available commands with short description.
--help=opts
Show available options; short form.
--help=options
Show available options with their description.
--help=cmds
Show available internal commands with short description.
--help=checks
Show available commands for checks.
--help=data
--help=info
Show available commands for information.
--help=tools
Description of tools around O-Saft, when, where and how to use.
--help=cfg-cmd
Show additional and user specified commands. Output can be used in
rc-file or as option.
--help=check-cfg
--help=cfg-check
Show texts used as labels in output for checks (see +check) ready
for use in rc-file or as option.
--help=data-cfg
--help=cfg-data
--help=cfg-info
Show texts used as labels in output for data (see +info) ready
for use in rc-file or as option.
--help=hint
Show texts used in hint messages.
--help=hint-cfg
--help=cfg-hint
Show texts used in hint messages ready for use in the rc-file or as
option.
--help=text
Show texts used in various messages.
--help=text-cfg
--help=cfg-text
Show texts used in various messages ready for use in the rc-file or
as option.
--help=legacy
Show possible legacy formats (used as value in --legacy=TOOL).
--help=compliance
Show available compliance checks.
--help=intern
Show all internal commands and command lists.
--help=alias
Show alias for commands and options.
--help=pattern
Show list of cipher pattern (used for --cipher=CIPHER).
--help=range
Show list of cipherranges (see --cipherrange=RANGE).
# score will be removed, so don't anounce it
# --help=score
#
# Show score value for each check.
# Value is printed in format to be used for --cfg-score=KEY=SCORE.
#
# Note that the sequence of options is important. Use the options
# --trace and/or --cfg-score=KEY=SCORE before --help=score.
#
--help=toc
--help=content
Show headlines from help text. Useful to get an overview.
--help=SECTION
Show 'SECTION' from documentation, see --help=toc for a list.
Example:
$0 --help=EXAMPLES
--help=ourstr
Show regular expressions to match our own strings used in output.
--help=regex
Show regular expressions used internally.
--help=gen-html
Print documentation in HTML format.
--help=gen-pod
Print documentation in POD format.
--help=gen-wiki
Print documentation in mediawiki format.
--help=gen-cgi
Print HTML form to be used for CGI.
--help=error
--help=problem
Show KNOWN PROBLEMS section with description of known error and
warning messages.
--help=faq
Show KNOWN PROBLEMS and LIMITATIONS section.
--help=glossary
Show common abbreviation used in the world of security.
--help=links
Show list of URLs related to SSL/TLS.
--help=rfc
Show list of RFC related to SSL/TLS.
--help=todo
Show known problems and bugs.
--help=exit
Show possible --exit=KEY options. Used for debugging only.
--help=warnings
Show warning messages defined in code.
--help=program.code
For developers.
Options for all commands (general)
--dns
Do DNS lookups to map given hostname to IP, do a reverse lookup.
--no-dns
Do not make DNS lookups.
Note that the corresponding IP and reverse hostname may be missing
in some messages then.
--host=HOST
Specify HOST as target to be checked. Legacy option.
--port=PORT
Specify PORT of target to be used. Legacy option.
--host=HOST --port=PORT HOST:PORT HOST
When giving more than one HOST argument, the sequence of the given
HOST argument and the given --port=PORT and the given --host=HOST
options are important.
The rule how ports and hosts are mapped is as follows:
* HOST:PORT arguments are used as is (connection to HOST on PORT)
* only HOST is given, then previous specified PORT is used