TLS Test Script

Matthias Leisi

Sunday, August 27. 2006

TLS Test Script

For the series of articles on X.509 certificates, TLS and other items related to secure e-mail, I wrote a script to quickly gather data for a particular domain with regard to how their e-mail system is set up. The script can be downloaded here. Documentation is within the file.

If you have any improvements, please drop me a note (e-mail address is within the script).

Prerequisites

  • Perl
  • Net::DNS
  • IO::Socket::SSL
  • IO::Socket::INET

Sample output

matthias@asterix:~/tmp> ./tls-tester.pl leisi.net
domain  leisi.net
mx      mail.leisi.net
ip      213.144.132.251
rdns    trillian.net.astrum.ch.
banner  mail.leisi.net
tls     yes
cn      mail.leisi.net
cnmatch exact
issuer  O=leisi.net/OU=leisi.net Server CA/CN=leisi.net Server CA
cipher  DHE-RSA-AES256-SHA

Known Bugs

  • When retrieving certificates from MessageLabs via the openssl command, the command seems to hang “forever”. This only seems to happen with MessageLabs
  • Certain non-responding mailservers sometimes seem to completely hang the script (currently, this happens with the MXes for groups.yahoo.com).
  • No nice error reporting.
  • Most likely a lot more.

Licence & Warning

  • The script is your’s to play with.
  • Be careful to only test / play with your own infrastructure. Using this script on other people’s servers may put you in trouble.
Posted by Matthias Leisi in Security, Software at 18:06 | Comments (2) | Trackbacks (0)

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

Hello,

whats this error for?
I can’t find any error in my Script :-(

Can not open cert file for writing: Datei oder Verzeichnis nicht gefunden

Why he must have write permissions to my certfile?

LG
Snitch

#1 snitch (Homepage) on 2007-09-09 19:35 (Reply)

Hi Matthew..

I have experience of Messagelabs TLS service, and would suggest the reason you experience this problem is due to the lack of Messagelabs CA Root Certificate, in your CA Certificate bundle.

You can download the Trustis CA Root Certificate here:

https://trustis-ssl.trustis.com/support/certinstall/index.htm

If you install the Trustis CA Root certificate you’ll find this will resolve your problem, it did for me :)

David Moore.

#2 David Moore on 2007-11-30 11:03 (Reply)

Add Comment

Textile-formatting allowed
E-Mail addresses will not be displayed and will only be used for E-Mail notifications

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA
 
 

Quicksearch

Blog abonnieren

Blog Administration

Open login screen

Rights & Wrongs

Creative Commons License - Some Rights Reserved
Original content in this work is licensed under a Creative Commons License