iiinova — where your digital self keeps evolving

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 25/10/2026

www.heise.de/en/news/GoDaddy-revoke… > Because they don’t match their documentation, #GoDaddy must revoke 404,607 #certificates, including those used by companies such as Host Europe and DomainFactory.

Just a teaser with https:// in the location bar

002 2

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 22/06/2026

New feature coming in: DNS HTTP Resource Record in testssl.sh 3.3dev PR github.com/testssl/testssl.sh/pull/… will be merged by tomorrow. The dig command from MacOS delivers not the records in clear text but a byte stream. That made it necessary […] [Original post on infosec.exchange]

DNS HTTPS RR (expt.): yes: 1 . alpn="h3,h2" ipv4hint=104.21.34.154,172.67.205.231
ech=AEX+DQBBRAAgACBmZ5hm4SBIISaPEuHBb16If3PdpXonXf6lc+JEmDSxbgAEAAEAAQASY2xvdWRmbGFyZS1lY2guY29tAAA=
ipv6hint=2606:4700:3032::6815:229a,2606:4700:3033::ac43:cde7
Service detected: HTTP

Testing protocols via sockets except NPN+ALPN

SSLv2 not offered (OK)
SSLv3 not offered (OK)
TLS 1 not offered
TLS 1.1 not offered
TLS 1.2 offered (OK)
TLS 1.3 offered (OK): final
QUIC offered (OK): QUICv1 (h3), as advertised in DNS HTTPS RR
NPN/SPDY h2, http/1.1 (advertised)
ALPN/HTTP2 h2, http/1.1 (offered)

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 20/06/2026

Thanks to potato-20 who revived an old PR from tosticated , testssl.sh 3.3dev now also has a check against the HSTS preload list -- when "--phone-out" is supplied.

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 18/05/2026

Update of client simulation has landed in 3.3dev Using ja3/ja4 checksums some simulations were able to identify as the same so that it was possible to put them in one line.

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 18/05/2026

The will be a bigger update on the client simulation soon - Apple's OS 26.x finally support one #KEM (X25519MLKEM768) - #OpenSSL >=4.0.0 comes with new curves, some #SM2 related. And with a whopping 27 signature algorithms #PQC

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 13/02/2026

Also, it was time to release a snapshot of the 3.3dev branch which stabilized well enough and has a good set of features to be released. github.com/testssl/testssl.sh/relea… Enjoy && eat the meal while it's hot ;-)

See https://github.com/testssl/testssl.sh/releases/tag/v3.3dev-snapshot-2602

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 12/02/2026

Smal version bump: 3.2.3 for the old branch of testssl.sh was just released github.com/testssl/testssl.sh/relea… Get it while it's hot ;-)

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 09/10/2025

testssl.sh 3.3dev now has (finally) early data support a.k.a 0-RTT .

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 01/10/2025

@bagder Just the command line for testing the next incarnation of my server (IPs aren't final, thus masked here) Much appreciated, thanks!

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 01/10/2025

Willing to help? See github.com/testssl/testssl.sh/issue… I am curious whether Apple finally made a step toward #PQC to catch up with all other major browser vendors with the release of version 26 of their operating systems. They lag behind since months: #TLS

Handshake simulation of testssl.sh which shows that all major browsers have sent a so called hybrid KEM (X25519MLKEM768) during the TLS ClientHello

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 31/07/2025

testssl.sh 3.3dev got a bit snappier, most notably for Macs: #TLS #SSL #pentesting

Pic shows a protocol scan of testssl.net taking 8 seconds

Pic shows a protocol scan of testssl.net taking 13 seconds

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 03/07/2025

First draft for #QUIC test is there as a PR for 3.3dev

Pic shows a scan where a QUIC row appears below TLS 1.3

This shows a pic in which QUIC seems not supported by OpenSSL

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 15/06/2025

The last release of testssl.sh in the 3.0.10 branch was made which includes several bugfixes. Get it from here: github.com/testssl/testssl.sh/relea…

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 20/05/2025

Branch 3.2 has now also a github action running under MacOS which permits dealing with compatibility issue in the very beginning, i.e. when write a PR And it has more badges now ;-) -- including the status of the Ubuntu and MacOS CI runner.

Badges in the Readme @ github, including the Github runners for Ubuntu and MacOS

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 08/05/2025

Can someone assist writing a unit test for #github using a MacOS runner? github.com/testssl/testssl.sh/issue… RTs welcome

Looks like the MacOS 14 runner is free: https://github.com/orgs/community/discussions/102846 for public repos.

Can somebody test a github runner for this repo?

Currently our Ubuntu runner with perl is here: https://github.com/testssl/testssl.sh/blob/3.2/.github/workflows/unit_tests.yml . Just one check with testssl.sh would suffice. It doesn't have to be perl. Anything which works is fine.

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 25/04/2025

Here is a scan from testssl.net (which is at cloudflare and proxies testssl.sh) -- watch out for the #MLKEM(s) #PQC

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 10/04/2025

Some browsers and also #OPenSSL 3.5.0 support already #PQ #KEMs for key exchange to to provide secure key establishment resistance. The (real soon now) to be released testssl.sh 3.2 final will include handshake simulation, see last column:

201 2

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 09/04/2025

testssl.sh (3.2rc4) has now a client simulation for #OpenSSL 3.5.0:

showing a row of the client simulation output

OpenSSL 3.5.0 (git) TLSv1.3 TLS_AES_128_GCM_SHA256 X25519MLKEM768

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 08/04/2025

#OpenSSL 3.5.0 LTS release with some #PQC algorithms, server side #QUIC support and more

100 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 12/03/2025

One of Google's intermediate CAs expired on March 9, fortunately this seems for chromecast devices only: www.reddit.com/r/Chromecast/comment…

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 04/02/2025

#redhat does their own CA thing for subscribed RHEL-machines (but see also CAA RR

001 1

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 31/01/2025

Testssl.sh just got a small new feature: when a server in the STARTTLS handshake signaling, you're too fast, it ĺl quit correctly . You basically can correct that using "STARTTLS_SLEEP=1 ./testssl.sh <target>"

Displays a testssl.sh run against a mail server complaining with STARTTLS error msg

000 0

testssl.sh :verified: @testssl.infosec.exchange.ap.brid.gy · 24/01/2025

Version 3.2rc4 of testssl.sh is out! It brings lots of fixes and improvements under the hood. The important new feature is the support of some KEMs (key encapsulation mechanism) , aka Post Quantum Hybrid Key Agreements -- thanks to David. Get it at […] [Original post on infosec.exchange]

000 0