$ show testssl/testssl.sh
testssl.sh is a mature, command-line Bash tool for comprehensive TLS/SSL security auditing of network services. It tests cipher support, protocol versions (SSLv2 through TLS 1.3), cryptographic vulnerabilities (Heartbleed, CCS, ROBOT, BEAST, POODLE, LOGJAM, FREAK, and many others), certificate validation, HTTP security headers, and STARTTLS on a wide range of protocols. The tool works by performing socket-level TLS handshakes and comparing results against embedded data files. It also includes a client simulation feature that replays ClientHellos from over 100 real-world browsers and libraries to detect server behavior differences. The architecture is a single large Bash script (testssl.sh) with supporting data files under etc/ and utility scripts in utils/. It is driven by command-line options and environment variables, producing output in terminal color, JSON, CSV, HTML, and log formats. The project has active maintenance with a thorough test suite and CI pipelines, though some data sources (e.g., SSL Labs API) are deprecated, and the client simulation data requires manual updates.
The LLM identified 4 files worth highlighting for reuse:
A structured text file mapping TLS cipher suite hex codes to OpenSSL names, IANA names, protocol version, key exchange, authentication, encryption, MAC, and legacy flags. This file is the single source of truth for all cipher-related lookups in testssl.sh and is designed for easy parsing and extension. It is reusable for any project that needs to translate between hex cipher suites and human-readable names, or identify weak ciphers.
A large collection of client TLS handshake definitions for over 100 real-world TLS clients (browsers, OS, libraries, bots). Each record defines the cipher list, protocol range, curves, ALPN, and raw hex handshake bytes. The format uses parallel Bash arrays and includes JA3/JA4 fingerprints. This is a valuable reusable asset for any tool that needs to simulate or fingerprint TLS clients, and the structured format allows easy addition of new clients.
A curated list of known Diffie-Hellman prime numbers, sourced from RFCs, nmap scripts, weakdh.org, and product defaults. Each entry is a labeled hex prime used for LOGJAM and FFDHE detection. The format is simple and reusable for any security tool that needs to check for weak or known DH groups.
A small, standalone Bash script that parses hex streams (e.g., from Wireshark or network captures) into human-readable cipher suite names. It uses the cipher-mapping.txt lookup table and is idempotent. This utility demonstrates a clean, portable pattern for converting raw TLS handshake data into usable output, and can be extracted for other projects dealing with TLS traffic.