Skip to content
forked from ouspg/trytls

Does ​your​ library check TLS certificates properly?

License

Notifications You must be signed in to change notification settings

timattil/trytls

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

TryTLS

Does your library check TLS certificates properly? Broken certificate checks seems to be an overlooked issue. Handling certificates is surprisingly complex, and calls for extra attention.

TryTLS is a tool for the software and library developers, vulnerability researchers, and end-users, who want to use TLS safely.

We hope to help you to test certificate handling easily. We support systematic and readily planned tests and try make integrating your favorite language and library easy.

How Does It Work?

Architecture

  • Backends use ports and virtual hosts to provide falsified/broken certificate checks
  • Stubs are written for the target languages and libraries to attempt the TLS connection
  • Runners "check the checks" by calling the stubs systematically to find out how libraries handle signatures, domain names, time, SNI etc. against the backends

Runners

We have a Python based test runner and a work-in-progress bash based test runner.

Installation

$ git clone https://github.com/ouspg/trytls.git
$ cd trytls
$ pip install .

In case you don't have pip installed, please refer to these instructions.

Usage

$ trytls https python stubs/python-urllib2/run.py
platform: OS X 10.11.5
runner: trytls 0.1.0 (CPython 2.7.10, OpenSSL 0.9.8zh)
stub: python 'stubs/python-urllib2/run.py'
 PASS expired certificate [reject expired.badssl.com:443]
 PASS wrong hostname in certificate [reject wrong.host.badssl.com:443]
 PASS self-signed certificate [reject self-signed.badssl.com:443]
  ...

Stubs

Stubs and their documentation can be found from the stubs/ directory.

Backends

We currently are working to support following backends:

Test runners allow user to test against all or any of these backends.

What TryTLS Is Not

  • We do not address possible client certificate check problems in server code
  • We do not do or require a man-in-the-middle tools
  • We do not support smart TVs, IoT toasters and other such devices that can't run the test driver

Found issues

Contributors

We invite people to contribute.

Contact us

  • Preferred: public tweet
  • Use #trytls and point it to @oupsg
  • Less public alternative: direct twitter-message to @ouspg

About

Does ​your​ library check TLS certificates properly?

Resources

License

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages

  • Python 39.5%
  • Shell 36.1%
  • C 5.6%
  • Java 4.8%
  • C# 3.9%
  • PHP 2.4%
  • Other 7.7%