sslyze v6.0 releases: Fast and powerful SSL/TLS server scanning library

by do son · Published June 12, 2019 · Updated March 31, 2024

SSLyze

Fast and powerful SSL/TLS server scanning library for Python 2.7 and 3.4+.

Description

SSLyze is a Python library and a CLI tool that can analyze the SSL configuration of a server by connecting to it. It is designed to be fast and comprehensive and should help organizations and testers identify misconfigurations affecting their SSL/TLS servers.

Key features include:

Fully documented Python API, in order to run scans and process the results directly from Python.
New: Support for TLS 1.3 (draft 18) and the ROBOT vulnerability.
Scans are automatically dispatched among multiple processes, making them very fast.
Performance testing: session resumption and TLS tickets support.
Security testing: weak cipher suites, insecure renegotiation, CRIME, Heartbleed and more.
Server certificate validation and revocation checking through OCSP stapling.
Support for StartTLS handshakes on SMTP, XMPP, LDAP, POP, IMAP, RDP, PostGres, and FTP.
Scan results can be written to an XML or JSON file for further processing.
And much more!

How does it work?

SSLyze is all Python code but it uses an OpenSSL wrapper written in C called nassl, which was specifically developed for allowing SSLyze to access the low-level OpenSSL APIs needed to perform deep SSL testing.

Changelog v6.0

Added support for Python 3.12 (#630).
Removed support for Python 3.7 (#616).
Switched to Python Cryptography’s implementation of certificate validation, in order to simplify the validation logic and make it more reliable (#638).
- Removed direct dependency to pyOpenSSL.
- Removed usages of ssl.match_hostname() (#627).
- JSON output changes for the certificate information plugin:
  - leaf_certificate_subject_matches_hostname has been removed because hostname validation is now directly reported in the path_validation_results, which makes it simpler to process them.
  - Similarly, openssl_error_string was renamed to validation_error.
Fixed crash caused by “invalid padding” and “invalid encoding” errors (#632, #634).
Better output when an SMTP EHLO is rejected ( #635).

Install

SSLyze can be installed directly via pip:

pip install --upgrade setuptools
pip install sslyze
sslyze --regular www.yahoo.com:443 www.google.com "[2607:f8b0:400a:807::2004]:443"

It is also easy to directly clone the repository and the fetch the requirements:

git clone https://github.com/nabla-c0d3/sslyze.git
cd sslyze
pip install -r requirements.txt --upgrade
python -m sslyze --regular www.yahoo.com:443 www.google.com "[2607:f8b0:400a:807::2004]:443"

On Linux, the python-dev package needs to be installed first so that the nassl C extension can be compiled: