Show HN: Simple SSL Scanner

https://www.expeditedssl.com/simple-ssl-scanner

by michaelbuckbee • 12 years ago

31 22 12 years ago

I made this in large part because it can be so difficult to convince a non-technical stakeholder of the importance of some security aspects. With the report, this gets much easier.

chilgart• 12 years ago

It's a neat site, but can you explain why I would use it over https://www.ssllabs.com/?

michaelbuckbee4• 12 years ago

I really like SSLLabs and their report, but it's really too technical to hand to a lot of people.

Further, though this isn't really explained well, is that there are some optional security elements like http->https redirection, HSTS that are just blips on the SSLLabs report that I think should be of more importance.

The Simple report was meant to be a sort of executive summary, not a deep dive.

jjd1103• 12 years ago

ssllabs took > 5 mins for a couple of sites i tried, while OP's was pretty instantaneous. It gave more detail, to be fair, but in terms of trying to catalyze a decision from a non-technical decision-maker, or for a quick sanity-check, I think I'd reach for expeditedssl.com first.

finnn2• 12 years ago

https://www.expeditedssl.com/simple-ssl-scanner/scan?target_...

You only pass 4 out of 5 of our own test :P.

michaelbuckbee4• 12 years ago

I know, that signature check really only applies if you are buying long lived certs as otherwise it'll be updated in your next renewal (which is the situation we're in).

Though, you're probably right that I should upgrade it sooner (see, the scanner is working and forcing people to upgrade - including myself).

finnn2• 12 years ago

I also don't pass that test, but I don't know how to fix it. Something that bugs me about both this and the SSL Labs scanner is there's no guide to fixing problems. Obviously it's different from webserver to webserver, but I feel like at least Nginx and Apache suggestions should be there. Maybe lighttpd and whatever else kids are using now a days

ErikRogneby• 12 years ago

I was just trying this out on some different sites. www.amazon.com got 2/5. I tried www.whitehouse.gov and it didn't work. I went to check it and it appears their certs aren't set up properly on the CDN they are using (akamai.net). Embarrassing!

michaelbuckbee4• 12 years ago

They're fine. It's more they've made the decision to NOT force all their visitors to SSL.

Artemis2• 12 years ago

Also, most of the time, sites without a perfect forward secrecy policy are sites intended to be accessed by a very wide crowd, including people still running IE6 (and bellow). Sometimes you just can't push the new technologies fast enough.

jfaucett3• 12 years ago

Anyone notice how google issues themself a certificate. for some crazy reason I see different results when I sign my own certs on my server... man the cert issuer oligopoly sucks...

aroch4• 12 years ago

That's because Google is a intermediary CA[1], pretty much all large institutions that use certificates for authentication are. For example, a good number universities use internet2 as a backbone and issue themselves certs under an umbrella intermediary called InCommon.

Becoming an intermediary is hard and expensive because we want the CA system to be as secure as possible. And some security measures and auditing takes money

[1] https://pki.google.com/

jfaucett3• 12 years ago

I know sorry my irony wasnt that explicit I guess. Really I dont see how making it hard and expensive to become a CA intermediary helps security at all, it just means we have to trust those that have money and power, rarely the best idea.

leni536• 12 years ago

Good site. I wasn't even aware of HSTS until now. Although the lack off HSTS shouldn't affect users who check the url bar for https connection. On the other hand there is no reason not to add this into the configuration since it is trivial.

Also where is firefox's HSTS cache? Can I see it? It would be interesting.

aroch4• 12 years ago

Checkout: about:permissions

You can remove HSTS cache per-site by selecting "Forget About This Site" -- HSTS is still cached in any currently opened tabs though

waterside81• 12 years ago

If you permanently redirect http to https, is the HSTS header still needed?

jamoes• 12 years ago

The HSTS header is valuable because it prevents all future requests from the client from ever going over HTTP.

So, for example, after visiting Hacker News once, the next time you type "news.ycombinator.com" into the URL bar, your browser will simply go directly to "https://news.ycombinator.com", rather than making the initial request to "http://news.ycombinator.com" as it usually would. This ensures that all future communications between the client and server are over a secure channel.

Show HN: Simple SSL Scanner

Related Stories