TLS / OpenSSL

SslStream (.NET) Bordmittel

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
"NotAfter {0}  ({1} days left)" -f $cert.NotAfter, ($cert.NotAfter - (Get-Date)).Days
$ssl.Dispose(); $c.Close()

openssl Zusatztool

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>$null | openssl x509 -noout -enddate

openssl Bordmittel

echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>/dev/null | openssl x509 -noout -enddate
echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com 2>/dev/null | openssl x509 -noout -checkend 2592000 && echo "valid >30d" || echo "expires <30d"

curl Zusatztool

curl -sSv "https://mail.example.com:443" 2>&1 | grep -E "expire|subject:|issuer:"

X509Chain (.NET) Bordmittel

$h = "mail.example.com"; $p = 443
$c = New-Object Net.Sockets.TcpClient($h, $p)
$ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
$cert = [Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate
$chain = New-Object Security.Cryptography.X509Certificates.X509Chain
$chain.ChainPolicy.RevocationMode = "NoCheck"
[void]$chain.Build($cert)
$chain.ChainElements | ForEach-Object { $_.Certificate.Subject }
$ssl.Dispose(); $c.Close()

openssl Zusatztool

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com -showcerts 2>$null

openssl Bordmittel

openssl s_client -connect mail.example.com:443 -servername mail.example.com -showcerts </dev/null 2>/dev/null | grep -E "^ *(s:|i:)"

gnutls-cli Zusatztool

gnutls-cli --print-cert mail.example.com:443 </dev/null 2>/dev/null | grep -E "Subject:|Issuer:"

SslStream (.NET) Bordmittel

foreach ($proto in "Tls12", "Tls13") {
  try {
    $c = New-Object Net.Sockets.TcpClient("mail.example.com", 443)
    $ssl = New-Object Net.Security.SslStream($c.GetStream(), $false, ({ $true }))
    $ssl.AuthenticateAsClient("mail.example.com", $null, [Security.Authentication.SslProtocols]$proto, $false)
    "$proto ok: $($ssl.SslProtocol) / $($ssl.CipherAlgorithm)"
    $ssl.Dispose(); $c.Close()
  } catch { "$proto not supported" }
}

openssl Zusatztool

"" | openssl s_client -connect mail.example.com:443 -servername mail.example.com -tls1_2 2>$null | Select-String "Protocol"

openssl Bordmittel

for proto in -tls1 -tls1_1 -tls1_2 -tls1_3; do
  echo | openssl s_client -connect mail.example.com:443 -servername mail.example.com $proto >/dev/null 2>&1 \
    && echo "$proto supported" || echo "$proto not"
done

nmap Zusatztool

nmap --script ssl-enum-ciphers -p 443 mail.example.com

SslStream (.NET) Bordmittel

$h = "mail.example.com"; $p = 25
$c = New-Object Net.Sockets.TcpClient($h, $p)
$s = $c.GetStream()
$r = New-Object IO.StreamReader($s)
$w = New-Object IO.StreamWriter($s); $w.NewLine = "`r`n"; $w.AutoFlush = $true
$r.ReadLine() | Out-Null
$w.WriteLine("EHLO test.example.com"); Start-Sleep -Milliseconds 200; while ($c.Available) { $r.ReadLine() | Out-Null }
$w.WriteLine("STARTTLS"); $r.ReadLine()
$ssl = New-Object Net.Security.SslStream($s, $false, ({ $true }))
$ssl.AuthenticateAsClient($h)
([Security.Cryptography.X509Certificates.X509Certificate2]$ssl.RemoteCertificate) | Format-List Subject, Issuer, NotBefore, NotAfter
$ssl.Dispose(); $c.Close()

openssl Zusatztool

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com

openssl Bordmittel

openssl s_client -starttls smtp -connect mail.example.com:25 -servername mail.example.com </dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

swaks Zusatztool

swaks --server mail.example.com:25 -tls --quit-after TLS

X509Certificate2 (.NET) Bordmittel

$cert = New-Object Security.Cryptography.X509Certificates.X509Certificate2 "cert.pem"
$cert | Format-List Subject, Issuer, NotBefore, NotAfter, DnsNameList, Thumbprint

openssl Zusatztool

openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

openssl Bordmittel

openssl x509 -in cert.pem -noout -subject -issuer -dates -ext subjectAltName

certtool Zusatztool

certtool --certificate-info --infile cert.pem