SSLyze
SSLyze is a fast and powerful SSL/TLS scanning tool and Python library.
SSLyze can analyze the SSL/TLS configuration of a server by connecting to it, in order to ensure that it uses strong encryption settings (certificate, cipher suites, elliptic curves, etc.), and that it is not vulnerable to known TLS attacks (Heartbleed, ROBOT, OpenSSL CCS injection, etc.).
Key features
- Focus on speed and reliability: SSLyze is a battle-tested tool that is used to reliably scan hundreds of thousands of servers every day.
- Easy to operationalize: SSLyze can be directly run from CI/CD, in order to continuously check a server against Mozilla's recommended TLS configuration.
- Fully documented Python API to run scans directly from any Python application, such as a function deployed to AWS Lambda.
- Support for scanning non-HTTP servers including SMTP, XMPP, LDAP, POP, IMAP, RDP, Postgres and FTP servers.
- Results of a scan can easily be saved to a JSON file for later processing.
- And much more!
Quick start
On Windows, Linux (x86 or x64) and macOS, SSLyze can be installed directly via pip:
$ pip install --upgrade pip setuptools wheel
$ pip install --upgrade sslyze
$ python -m sslyze www.yahoo.com www.google.com "[2607:f8b0:400a:807::2004]:443"
It can also be used via Docker:
$ docker run --rm -it nablac0d3/sslyze:5.0.0 www.google.com
Lastly, a pre-compiled Windows executable can be downloaded from the Releases page.
Python API Documentation
Documentation for SSLyze's Python API is available here.
Usage as a CI/CD step
By default, SSLyze will check the server's scan results against Mozilla's recommended "intermediate" TLS configuration, and will return a non-zero exit code if the server is not compliant.
$ python -m sslyze mozilla.com
Checking results against Mozilla's "intermediate" configuration. See https://ssl-config.mozilla.org/ for more details.
mozilla.com:443: OK - Compliant.
The Mozilla configuration to check against can be configured via --mozilla-config={old, intermediate, modern}:
$ python -m sslyze --mozilla-config=modern mozilla.com
Checking results against Mozilla's "modern" configuration. See https://ssl-config.mozilla.org/ for more details.
mozilla.com:443: FAILED - Not compliant.
* certificate_types: Deployed certificate types are {'rsa'}, should have at least one of {'ecdsa'}.
* certificate_signatures: Deployed certificate signatures are {'sha256WithRSAEncryption'}, should have at least one of {'ecdsa-with-SHA512', 'ecdsa-with-SHA256', 'ecdsa-with-SHA384'}.
* tls_versions: TLS versions {'TLSv1.2'} are supported, but should be rejected.
* ciphers: Cipher suites {'TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384', 'TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305_SHA256', 'TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256'} are supported, but should be rejected.
This can be used to easily run an SSLyze scan as a CI/CD step.
Development environment
To setup a development environment:
$ pip install --upgrade pip setuptools wheel
$ pip install -e .
$ pip install -r dev-requirements.txt
The tests can then be run using:
$ invoke test
License
Copyright (c) 2021 Alban Diquet
SSLyze is made available under the terms of the GNU Affero General Public License (AGPL). See LICENSE.txt for details and exceptions.
130 Dec 15, 2022
10 Sep 25, 2022
2 Mar 19, 2022
62 Jan 08, 2023
2 Sep 12, 2022
39 Nov 28, 2022
9 Jun 01, 2022
66 Dec 08, 2022
1.5k Jan 04, 2023
112 Dec 01, 2022
40.3k Jan 09, 2023
1 Jan 10, 2022
580 Jan 09, 2023
3 Nov 28, 2021
77 Dec 16, 2022
9 Aug 31, 2022
9 Dec 12, 2022
46 Dec 21, 2022
2 Dec 24, 2021
2 Dec 16, 2021