testssl.sh for TLS and SSL Security Testing

October 7, 2022

testssl.sh is a free, open-source command-line utility for assessing TLS and SSL configurations on network services. It checks supported protocols, cipher suites, and known cryptographic weaknesses on a target server. Although commonly used to audit HTTPS websites, it can also test other TLS-enabled services and STARTTLS endpoints running on different ports.

Security administrators, penetration testers, and system engineers can use testssl.sh to identify outdated encryption settings, weak cipher configurations, and protocol-level security issues. Its local execution model also means scan results remain on the machine running the tool rather than being sent to an external scanning service.

Key Features of testssl.sh

Readable results: Presents findings in a clear format, making it easier to distinguish secure configurations from potential weaknesses.
Machine-readable reports: Supports CSV and two JSON output formats for automation, reporting, and integration with other tools.
Minimal setup: Runs without requiring language-specific package managers such as pip, CPAN, or RubyGems.
Cross-platform support: Works on Linux, macOS, FreeBSD, NetBSD, MSYS2, Cygwin, and Windows Subsystem for Linux.
Flexible target testing: Supports TLS-enabled services and STARTTLS protocols, not just HTTPS on port 443.
Command-line options: Provides switches for selecting individual tests, adjusting scan behavior, and controlling report output.
Container support: Includes a Dockerfile and an official Docker Hub image for running tests in a container.
Open-source development: The source code is publicly available on GitHub, allowing users to inspect the implementation and contribute improvements.

Platform Compatibility

testssl.sh supports a wide range of Linux and BSD distributions. It also runs on other Unix-like environments that provide Bash 3.2 or later, along with standard command-line utilities such as sed and awk.

The project uses Bash-based socket checks to reduce reliance on features that may be unavailable in a particular OpenSSL client. This approach improves compatibility with different cryptographic library environments, including LibreSSL and OpenSSL 1.1.1 or later, as described in the project’s documentation.

macOS and Windows environments are supported through compatible shells such as MSYS2, Cygwin, and WSL. Some older Unix systems may require additional utilities, such as GNU grep. The tool also performs checks for required binaries when it starts.

Installing testssl.sh on Linux

The source code can be downloaded directly from the official GitHub repository. The following command clones the development branch with a shallow Git history:

git clone --depth 1 https://github.com/drwetter/testssl.sh.git

Move into the downloaded directory and display the available command-line options:

cd testssl.sh
./testssl.sh --help

The cloned development branch is a rolling release, so its behavior and features may change. Users who need a more predictable environment should select a stable release or branch instead of automatically relying on development code.

Running testssl.sh with Docker

Docker provides another way to use testssl.sh without manually setting up its dependencies. The project publishes a container image that can be launched directly:

docker run --rm -ti drwetter/testssl.sh

To test a specific hostname, provide the target as an argument:

docker run --rm -t drwetter/testssl.sh example.com

You can also build a local image from a cloned repository:

cd testssl.sh
docker build . -t imagefoo
docker run --rm -t imagefoo example.com

Replace example.com with a domain or service you are authorized to assess. For additional container configuration options, consult the project’s Docker documentation.

Project Development and Version Status

The supplied project documentation describes the 3.1 development branch as a rolling release intended to lead toward version 3.2. Development features are integrated into this branch as they mature, while the 3.0 series is maintained separately for users who prefer a more stable release.

Under that release model, 3.0.x receives maintenance updates such as bug fixes, while the development branch may introduce changes more frequently. The documentation also notes that support for version 2.9.5 has been discontinued.

These version details reflect the release information in the supplied project description. Check the current repository before choosing a branch, since development and maintenance status can change.

Documentation and Resources

testssl.sh includes documentation in several formats, including a groff man page, HTML, and Markdown files in its documentation directory. The official website provides an introduction to the tool, while the GitHub repository contains installation guidance, usage examples, and project updates.

For broader network reconnaissance, you can also explore Nmap, which helps identify exposed services and gather information about network hosts. Combining service discovery with TLS configuration checks can provide a more complete view of a system’s externally exposed security posture.

Responsible use: Run testssl.sh only against systems you own or have explicit permission to assess. TLS testing can generate network traffic and should be included in the agreed scope of any security assessment.