My weekend project.<p>* Tries to give all the information you need instead of a rating.<p>* Open source, so you can self host it.<p>* Does the entire certificate chain.<p>* Allows to paste a CRL/Cert<p>* Validates the certificate, chain, CRL and OCSP (of every cert in the chain)<p>* Has easy copy-pastable PEM versions of certs<p>* Ciphersuite enumeration as an option.<p>* Fast.
These services always dock me for including RC4 ciphers. I understand that these are bad because RC4 is broken or near broken; I shouldn't be using it.<p>However, I'm simply using load balancering sevices provided by AWS and Rackspace; my understanding is that (since they perform SSL termination) it is their software on the load balancer that chooses the ciphers, and as far as I know, I cannot change this. Are they misconfigured? (why?) Is there any way to work around it short of doing the load balancing myself?
Thanks, looks great!<p>I'd like to see a check for SSLv2. For instance this site supports sslv2 and it should be flagged: download.biscom.com.<p><a href="https://www.ssllabs.com/ssltest/analyze.html?d=download.biscom.com" rel="nofollow">https://www.ssllabs.com/ssltest/analyze.html?d=download.bisc...</a>
I've tweaked my Apache configuration but don't seem to be able to trigger a rescan--the cipher list doesn't appear to change. I guess it's cached for a little while, but the UI doesn't make that clear.<p>Also, it's flagging the following ciphers:<p><pre><code> ECDHE-RSA-DES-CBC3-SHA
EDH-RSA-DES-CBC3-SHA
DES-CBC3-SHA
</code></pre>
These are triple-DES though, rather than just single DES. Is that considered weak these days?
Feature/bug: It doesn't seem to attempt to explicitly negotiate older protocols. For instance, I'm dealing with a site that still has SSLv2 and export ciphers enabled if a client requests it. (Like, if I run openssl s_client -ssl2.) SSLlabs detects this, but tls.so doesn't.
I started to build a similar thing, for the command line, last year but did not get as far.<p><a href="https://github.com/jamescun/ssltest" rel="nofollow">https://github.com/jamescun/ssltest</a>
Thank you for putting this all together and making it open source. By the way, will you be releasing an API? I think this API would be really valuable.