websec-audit/docs/modules/ssl.md

title, description

title	description
Module 04 · SSL/TLS	Full SSL/TLS analysis — deprecated protocols, weak ciphers, certificate expiry and HSTS.

Module 04 · SSL/TLS

Flag: --skip-ssl

!!! info This module is automatically skipped if the target is served over plain HTTP. In that case, a HIGH finding is raised: "Target is served over HTTP (no TLS)".

---

Checks performed

Protocol support

Flags deprecated and vulnerable protocols:

Protocol	Severity
SSLv2	HIGH
SSLv3	HIGH
TLS 1.0	HIGH
TLS 1.1	HIGH
TLS 1.2	✅ Acceptable
TLS 1.3	✅ Preferred

Cipher suites

Flags weak or broken ciphers:

• RC4, NULL, EXPORT, anonymous (anon), DES, 3DES → HIGH

Certificate validity

Condition	Severity
Certificate expired	CRITICAL
Expires in < 14 days	CRITICAL
Expires in < 30 days	HIGH
Expires in < 90 days	MEDIUM
Self-signed / untrusted	HIGH

HSTS

Condition	Severity
HSTS header absent	MEDIUM
max-age < 15552000 (6 months)	LOW

---

Tool priority

1. testssl.sh — comprehensive analysis, JSON output parsed automatically
2. sslscan — protocol and cipher enumeration
3. openssl — fallback, manual protocol checks

---

Output files

ssl/
├── testssl.json      # if testssl.sh available
├── testssl.log
├── sslscan.txt       # if sslscan available
└── openssl_info.txt  # fallback