TLS-Timeout on several hosts

aeris / cryptcheck

Verify some SSL/TLS website or XMPP implementation

GNU Affero General Public License v3.0

185 stars 20 forks source link

TLS-Timeout on several hosts #39

Open sauttefk opened 5 years ago

sauttefk commented 5 years ago

I get an error on several hosts e.g. for https://spiegel.de/

On the webservice: https://tls.imirhil.fr/https/spiegel.de

[HTTPS] spiegel.de (03/12/2018 15:12:22 +00:00)
spiegel.de - 128.65.210.8 : 443
Fehler bei der Analyse: Timeout when TLS connect to 128.65.210.8:443 (max 20 seconds)

And also on the shell: docker run --rm cryptcheck bin/check_https spiegel.de

128.65.210.8:443 [spiegel.de]

Supported methods
  Method TLSv1_2
  Method TLSv1_1
  Method TLSv1
Timeout when TLS connecting to 128.65.210.8:443 (max 20 seconds)

sauttefk commented 5 years ago

@aeris Oh, I forgot to mention: Cryptcheck is a really great tool for analysing all those webservers I have to manage! Thanks!

aeris commented 5 years ago

Seems the service on the other side is not fully SSL/TLS compliant. SSLv2 negociation hangs and so max analysis duration is hit. If the service doesn't support SSLv2, it needs to reject the connection cleanly (fatal protocol version).

screenshot_20181203_162204 screenshot_20181203_162846

sauttefk commented 5 years ago

OK, good point... But I think cryptcheck should respond graceful to this server side misconfiguration and continue it's analysis.

aeris commented 5 years ago

I limit the analysis duration to avoid DoS of the CryptCheck service (20s max for a TCP connection and 10min max for the overall scan). Will think about adding an option to ignore some timeout.

sauttefk commented 5 years ago

I think the 20s timeout is OK. This should be reported in the output, but all the other results should still be reported.

aeris commented 5 years ago

At this point, there is no result to report, this is just fast TLS ping to detect supported protocols. Perhaps I may consider errors at this point as "not supported protocol" rather than "server error". But this may hide misconfiguration too.

sauttefk commented 5 years ago

SSL Labs shows SSLv2 and SSLv3 as not supported. https://www.ssllabs.com/ssltest/analyze.html?d=spiegel.de

aeris commented 5 years ago

Yep, but missed here the fact the server is not SSL/TLS compliant :joy: