tlsaudit

Documentation

Overview

Package tlsaudit audits TLS/SSL configuration of a remote server — an algorithmic reimplementation of testssl.sh (GPL Bash, drwetter/testssl.sh).

Since testssl.sh is GPL we cannot copy its source. Instead we studied its algorithm and reimplemented the same checks in pure Go using crypto/tls.

Checks implemented (mirrors testssl.sh check categories):

Protocol checks (run_protocols):

• SSLv3, TLS 1.0, TLS 1.1 negotiation (deprecated/insecure)
• TLS 1.2, TLS 1.3 support (required)

Certificate checks (run_server_certificate):

• Expiry: days remaining, expired flag, near-expiry warning (<30 days)
• Self-signed detection
• Key size (RSA < 2048 → weak; RSA < 1024 → critical)
• Signature algorithm (MD5/SHA1 → weak)
• Subject Alternative Names
• Issuer chain depth
• Wildcard certificate flag
• OCSP stapling (detected via TLS ConnectionState)

Cipher checks (run_ciphers):

• NULL cipher suites (no encryption)
• EXPORT-grade cipher suites (≤40-bit)
• RC4 cipher suites
• 3DES / DES cipher suites (SWEET32 risk)
• Anonymous cipher suites (no server auth)
• Forward secrecy: DHE/ECDHE present

Vulnerability flags (run_vulnerabilities):

• BEAST: TLS 1.0 + CBC cipher suite in use
• POODLE: SSLv3 negotiable
• LOGJAM: DHE_EXPORT cipher suite present
• FREAK: EXPORT_RSA cipher suite present
• SWEET32: 3DES cipher suite present (64-bit block)
• CRIME: TLS compression offered (Go stdlib never compresses — always safe)

Header checks (run_headers):

• HSTS: Strict-Transport-Security header present/missing
• X-Content-Type-Options: nosniff
• X-Frame-Options
• Content-Security-Policy

Native Go replacement: zero external binaries. Uses crypto/tls + net/http. Observability (dicas.md §16): slog for every check decision.

Index

• type Module
  • func New() *Module
  • func NewWithClient(c *http.Client) *Module
  • func (m *Module) Name() string
  • func (m *Module) Run(ctx context.Context, input module.Input) ([]module.Finding, error)

Types

type Module

type Module struct {
	// contains filtered or unexported fields
}

Module implements module.Module for TLS auditing.

func New

func New() *Module

New returns a Module with production defaults.

func NewWithClient

func NewWithClient(c *http.Client) *Module

NewWithClient replaces the HTTP client — used in tests with httptest.Server.

func (*Module) Name

func (m *Module) Name() string

func (*Module) Run

func (m *Module) Run(ctx context.Context, input module.Input) ([]module.Finding, error)

Run performs a full TLS audit of the target host.

input.Target must be a hostname or host:port (default port 443). input.URLs[0] is used as fallback if Target is empty.

Options:

• "port": override port (default "443")
• "skip_headers": "true" to skip HTTP header checks
• "skip_ciphers": "true" to skip per-cipher-suite probing
• "timeout": dial timeout in seconds (default "10")