TLS Test Script

Sunday, August 27. 2006

For the series of articles on X.509 certificates, TLS and other items related to secure e-mail, I wrote a script to quickly gather data for a particular domain with regard to how their e-mail system is set up. The script can be downloaded here. Documentation is within the file.

If you have any improvements, please drop me a note (e-mail address is within the script).

Prerequisites

Perl
Net::DNS
IO::Socket::SSL
IO::Socket::INET

Sample output

matthias@asterix:~/tmp> ./tls-tester.pl leisi.net
domain  leisi.net
mx      mail.leisi.net
ip      213.144.132.251
rdns    trillian.net.astrum.ch.
banner  mail.leisi.net
tls     yes
cn      mail.leisi.net
cnmatch exact
issuer  O=leisi.net/OU=leisi.net Server CA/CN=leisi.net Server CA
cipher  DHE-RSA-AES256-SHA

Known Bugs

When retrieving certificates from MessageLabs via the openssl command, the command seems to hang “forever”. This only seems to happen with MessageLabs
Certain non-responding mailservers sometimes seem to completely hang the script (currently, this happens with the MXes for groups.yahoo.com).
No nice error reporting.
Most likely a lot more.

Licence & Warning

The script is your’s to play with.
Be careful to only test / play with your own infrastructure. Using this script on other people’s servers may put you in trouble.

Posted by Matthias Leisi in Security, Software at 18:06 | Comments (2) | Trackbacks (0)

Trackbacks

Trackback specific URI for this entry

No Trackbacks

Comments

Display comments as (Linear | Threaded)

Hello,

whats this error for?
I can’t find any error in my Script :-(

Can not open cert file for writing: Datei oder Verzeichnis nicht gefunden

Why he must have write permissions to my certfile?

LG
Snitch

#1 snitch (Homepage) on 2007-09-09 19:35 (Reply)

Hi Matthew..

I have experience of Messagelabs TLS service, and would suggest the reason you experience this problem is due to the lack of Messagelabs CA Root Certificate, in your CA Certificate bundle.

You can download the Trustis CA Root Certificate here:

https://trustis-ssl.trustis.com/support/certinstall/index.htm

If you install the Trustis CA Root certificate you’ll find this will resolve your problem, it did for me :)

David Moore.

#2 David Moore on 2007-11-30 11:03 (Reply)

Add Comment

Name
Email
Homepage
In reply to
Comment	Textile-formatting allowed E-Mail addresses will not be displayed and will only be used for E-Mail notifications To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly. Enter the string from the spam-prevention image above:
	Remember Information? Subscribe to this entry