How do I install the Ssl Check skill?

Run npx skillmds@latest add zebbern/ssl-check in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

What does the Ssl Check skill do?

Analyze SSL/TLS configurations for security weaknesses and compliance. Use when testing HTTPS endpoints, when checking for TLS vulnerabilities, when validating certificates, or when auditing cipher suite configurations. It is listed under Security on SkillMD.

Is Ssl Check safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Ssl Check?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Ssl Check free to use?

Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.

Who published Ssl Check?

zebbern (@zebbern) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Ssl Check by zebbern — Agent Skill

Name: Ssl Check
Author: zebbern

ssl-check

When to Use

Target has HTTPS endpoints requiring TLS security assessment
Need to check for SSL/TLS vulnerabilities (Heartbleed, POODLE, BEAST, etc.)
Validating certificate chain and trust configuration
Auditing cipher suite strength and protocol versions
Testing STARTTLS services (SMTP, IMAP, POP3, FTP)
Checking compliance with Mozilla TLS configurations
Verifying forward secrecy and modern TLS support

Quick Start

Basic SSL/TLS scan with testssl.sh:

testssl.sh example.com

Tools Overview

Tool	Type	Best For
testssl.sh	Bash script	Comprehensive testing, vulnerability checks, no dependencies
sslyze	Python	Programmatic analysis, Mozilla compliance, concurrent scanning

Step-by-Step Process

Phase 1: Initial Assessment with testssl.sh

Run comprehensive scan

testssl.sh --json-pretty --severity LOW example.com

Check specific vulnerabilities
```
testssl.sh -U example.com
```
Analyze protocols and ciphers
```
testssl.sh -p -e example.com
```

Phase 2: Deep Analysis with sslyze

Full scan with JSON output

sslyze --json_out=scan_results.json example.com

Check Mozilla compliance

sslyze --mozilla_config=intermediate example.com

Multiple targets

sslyze target1.com target2.com target3.com

Phase 3: Certificate Analysis

Certificate chain validation
```
testssl.sh -S example.com
```
Detailed certificate info
```
sslyze example.com --certinfo
```

Examples

Example 1: Full Vulnerability Scan

Scenario: Complete SSL/TLS security assessment

Command:

testssl.sh -U --json-pretty example.com

Output:

{
  "id": "vulnerabilities",
  "finding": "not vulnerable",
  "severity": "OK",
  "cve": "CVE-2014-0160",
  "cwe": "CWE-126"
}

Example 2: Protocol Version Check

Scenario: Verify only secure TLS versions are enabled

Command:

testssl.sh -p example.com

Output:

SSLv2      not offered
SSLv3      not offered
TLS 1      not offered
TLS 1.1    not offered
TLS 1.2    offered
TLS 1.3    offered (final)

Example 3: Cipher Suite Analysis

Scenario: Enumerate all supported cipher suites

Command:

testssl.sh -E example.com

Output:

Hexcode  Cipher Suite Name (OpenSSL)       KeyExch.   Encryption  Bits
---------------------------------------------------------------------
 x1302   TLS_AES_256_GCM_SHA384            ECDH 253   AESGCM      256
 x1303   TLS_CHACHA20_POLY1305_SHA256      ECDH 253   ChaCha20    256
 x1301   TLS_AES_128_GCM_SHA256            ECDH 253   AESGCM      128

Example 4: Certificate Chain Validation

Scenario: Analyze certificate deployment

Command:

testssl.sh -S example.com

Output:

Certificate Validity (UTC)    2024-01-01 00:00 --> 2025-01-01 23:59
Signature Algorithm           SHA256withRSA
Issuer                        Let's Encrypt Authority X3
Trust (hostname)              Ok via SAN
Chain of trust                Ok

Example 5: Heartbleed Check

Scenario: Test for CVE-2014-0160

Command:

testssl.sh -H example.com

Output:

Heartbleed (CVE-2014-0160)    not vulnerable (OK)

Example 6: POODLE Check

Scenario: Test for SSL POODLE vulnerability

Command:

testssl.sh -O example.com

Output:

POODLE, SSL (CVE-2014-3566)   not vulnerable (OK)

Example 7: Mozilla Compliance Check

Scenario: Verify against Mozilla modern configuration

Command:

sslyze --mozilla_config=modern example.com

Output:

COMPLIANCE AGAINST MOZILLA TLS CONFIGURATION
--------------------------------------------
Checking results against Mozilla's "modern" configuration.

example.com:443: FAILED - Not compliant.
    * tls_versions: TLS 1.2 is supported, but not individual.
    * ciphers: TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 is not individual.

Example 8: STARTTLS Mail Server Scan

Scenario: Test SMTP server TLS configuration

Command:

testssl.sh --starttls smtp smtp.example.com:587

Output:

Testing protocols via STARTTLS handshake

SSLv2      not offered
SSLv3      not offered
TLS 1.2    offered
TLS 1.3    offered (final)

Example 9: sslyze STARTTLS Scan

Scenario: Test IMAP server with sslyze

Command:

sslyze --starttls imap imap.example.com:143

Output:

SCAN RESULTS FOR IMAP.EXAMPLE.COM:143
-------------------------------------
* TLS 1.3 Cipher Suites:
    TLS_AES_256_GCM_SHA384
    TLS_CHACHA20_POLY1305_SHA256

Example 10: JSON Output for Automation

Scenario: Generate machine-parseable results

Command:

testssl.sh --json example.com -oJ results.json

Output (results.json):

{
  "scanResult": [
    {
      "serverDefaults": {
        "cert_commonName": "example.com",
        "cert_notAfter": "2025-01-01"
      }
    }
  ]
}

Example 11: Concurrent Multi-Target Scan

Scenario: Scan multiple hosts efficiently

Command:

sslyze target1.com target2.com target3.com --json_out=multi.json

Output:

Scanned 3 servers in 12.5 seconds.

Example 12: Forward Secrecy Check

Scenario: Verify PFS cipher support

Command:

testssl.sh -f example.com

Output:

Forward Secrecy (PFS):  offered (OK)
  ECDHE-RSA-AES256-GCM-SHA384   ECDH 256
  ECDHE-RSA-AES128-GCM-SHA256   ECDH 256
  ECDHE-RSA-CHACHA20-POLY1305   ECDH 256

Example 13: RC4 Cipher Detection

Scenario: Check for weak RC4 ciphers

Command:

testssl.sh -4 example.com

Output:

RC4 (CVE-2013-2566, CVE-2015-2808)  no RC4 ciphers detected (OK)

Example 14: Mass Testing from File

Scenario: Batch scan multiple targets

Command:

testssl.sh --file targets.txt --parallel

targets.txt:

example1.com
example2.com:8443
https://example3.com/

Vulnerability Reference

Vulnerability	CVE	testssl.sh Flag	sslyze ScanCommand	Severity
Heartbleed	CVE-2014-0160	`-H`	`HEARTBLEED`	CRITICAL
CCS Injection	CVE-2014-0224	`-I`	`OPENSSL_CCS_INJECTION`	HIGH
POODLE (SSL)	CVE-2014-3566	`-O`	N/A	MEDIUM
BEAST	CVE-2011-3389	`-A`	N/A	MEDIUM
CRIME	CVE-2012-4929	`-C`	`TLS_COMPRESSION`	MEDIUM
BREACH	CVE-2013-3587	`-B`	N/A	MEDIUM
FREAK	CVE-2015-0204	`-F`	N/A	HIGH
LOGJAM	CVE-2015-4000	`-J`	N/A	HIGH
DROWN	CVE-2016-0800	`-D`	N/A	HIGH
SWEET32	CVE-2016-2183	`-W`	N/A	MEDIUM
ROBOT	CVE-2017-13099	`-BB`	`ROBOT`	HIGH
Ticketbleed	CVE-2016-9244	`-T`	N/A	MEDIUM
LUCKY13	CVE-2013-0169	`-L`	N/A	LOW
Renegotiation	CVE-2009-3555	`-R`	`SESSION_RENEGOTIATION`	MEDIUM

Protocol Security Reference

Protocol	Status	testssl.sh	sslyze ScanCommand
SSL 2.0	Deprecated	`-p`	`SSL_2_0_CIPHER_SUITES`
SSL 3.0	Deprecated	`-p`	`SSL_3_0_CIPHER_SUITES`
TLS 1.0	Deprecated	`-p`	`TLS_1_0_CIPHER_SUITES`
TLS 1.1	Deprecated	`-p`	`TLS_1_1_CIPHER_SUITES`
TLS 1.2	Acceptable	`-p`	`TLS_1_2_CIPHER_SUITES`
TLS 1.3	Recommended	`-p`	`TLS_1_3_CIPHER_SUITES`

testssl.sh Flag Reference

Flag	Description
`-p`	Check TLS/SSL protocols
`-e`	Check each local cipher remotely
`-E`	Check ciphers per protocol
`-s`	Test standard cipher lists by strength
`-S`	Server defaults and certificate info
`-P`	Server preference for protocol+cipher
`-h`	HTTP security headers
`-U`	All vulnerability checks
`-H`	Heartbleed check
`-I`	CCS injection check
`-O`	POODLE check
`-A`	BEAST check
`-C`	CRIME check (TLS compression)
`-B`	BREACH check
`-F`	FREAK check
`-J`	LOGJAM check
`-D`	DROWN check
`-W`	SWEET32 check
`-BB`	ROBOT check
`-T`	Ticketbleed check
`-R`	Renegotiation check
`-f`	Forward secrecy check
`-4`	RC4 cipher check
`--json`	Flat JSON output
`--json-pretty`	Pretty JSON output
`--csv`	CSV output
`--html`	HTML output
`--severity`	Filter by LOW/MEDIUM/HIGH/CRITICAL
`--starttls`	STARTTLS protocol (smtp/imap/pop3/ftp)
`--parallel`	Parallel scanning for mass tests
`--file`	Read targets from file

sslyze Flag Reference

Flag	Description
`--mozilla_config`	Check against Mozilla config (modern/intermediate/old)
`--json_out`	Output results to JSON file
`--starttls`	STARTTLS protocol (smtp/imap/pop3/ftp/ldap/rdp/postgres/xmpp)
`--certinfo`	Detailed certificate information
`--heartbleed`	Test for Heartbleed vulnerability
`--robot`	Test for ROBOT vulnerability
`--compression`	Test for TLS compression (CRIME)
`--fallback`	Test for TLS_FALLBACK_SCSV
`--reneg`	Test for insecure renegotiation

Output Parsing

Parse testssl.sh JSON with jq

# Extract all vulnerabilities
jq '.scanResult[].vulnerabilities[]' results.json

# Find critical issues
jq '.scanResult[] | select(.severity == "CRITICAL")' results.json

# Get certificate expiry
jq '.scanResult[].serverDefaults.cert_notAfter' results.json

# List supported protocols
jq '.scanResult[].protocols[] | select(.finding == "offered")' results.json

# Extract cipher suites
jq '.scanResult[].ciphers[] | select(.severity == "OK")' results.json

Parse sslyze JSON

# Get server scan status
jq '.server_scan_results[].scan_status' results.json

# Extract certificate info
jq '.server_scan_results[].scan_result.certificate_info' results.json

# Check for Heartbleed
jq '.server_scan_results[].scan_result.heartbleed.result.is_vulnerable_to_heartbleed' results.json

# List TLS 1.3 ciphers
jq '.server_scan_results[].scan_result.tls_1_3_cipher_suites.result.accepted_cipher_suites[].cipher_suite.name' results.json

Error Handling

Error	Cause	Resolution
`Connection refused`	Port not open or filtered	Verify port is accessible, check firewall
`Connection timed out`	Network issues or slow server	Use `--connect-timeout` to increase timeout
`hostname could not be resolved`	DNS resolution failed	Verify hostname, check DNS settings
`Certificate verification failed`	Self-signed or invalid cert	Expected for some targets, document finding
`No cipher suites in common`	Server/client cipher mismatch	Server may have restricted cipher list
`SSL routines:ssl3_read_bytes`	Protocol mismatch	Server may not support tested protocol
`unable to find STARTTLS`	STARTTLS not supported	Service may use direct TLS instead
`Proxy error`	Proxy configuration issue	Verify `--proxy` settings if using proxy
`command not found: testssl.sh`	Tool not installed	Install via package manager or clone repo
`sslyze: command not found`	Tool not installed	Install via `pip install sslyze`

Security Assessment Checklist

Critical (Must Fix)

SSL 2.0 disabled
SSL 3.0 disabled
TLS 1.0 disabled (if possible)
Not vulnerable to Heartbleed
Not vulnerable to ROBOT
Not vulnerable to DROWN

High Priority

TLS 1.1 disabled (if possible)
Not vulnerable to CCS Injection
Not vulnerable to FREAK
Not vulnerable to LOGJAM
Forward secrecy enabled

Medium Priority

TLS compression disabled (CRIME)
No SWEET32 vulnerable ciphers
Secure renegotiation supported
TLS_FALLBACK_SCSV supported

Best Practices

TLS 1.3 supported
Strong cipher suites only
Valid certificate chain
Certificate not expiring soon
HSTS header present

Ssl Check

File contents

ssl-check

When to Use

Quick Start

Tools Overview

Step-by-Step Process

Phase 1: Initial Assessment with testssl.sh

Phase 2: Deep Analysis with sslyze

Phase 3: Certificate Analysis

Examples

Example 1: Full Vulnerability Scan

Example 2: Protocol Version Check

Example 3: Cipher Suite Analysis

Example 4: Certificate Chain Validation

Example 5: Heartbleed Check

Example 6: POODLE Check

Example 7: Mozilla Compliance Check

Example 8: STARTTLS Mail Server Scan

Example 9: sslyze STARTTLS Scan

Example 10: JSON Output for Automation

Example 11: Concurrent Multi-Target Scan

Example 12: Forward Secrecy Check

Example 13: RC4 Cipher Detection

Example 14: Mass Testing from File

Vulnerability Reference

Protocol Security Reference

testssl.sh Flag Reference

sslyze Flag Reference

Output Parsing

Parse testssl.sh JSON with jq

Parse sslyze JSON

Error Handling

Security Assessment Checklist

Critical (Must Fix)

High Priority

Medium Priority

Best Practices

References

Frequently asked questions

Ssl Check

File contents

ssl-check

When to Use

Quick Start

Tools Overview

Step-by-Step Process

Phase 1: Initial Assessment with testssl.sh

Phase 2: Deep Analysis with sslyze

Phase 3: Certificate Analysis

Examples

Example 1: Full Vulnerability Scan

Example 2: Protocol Version Check

Example 3: Cipher Suite Analysis

Example 4: Certificate Chain Validation

Example 5: Heartbleed Check

Example 6: POODLE Check

Example 7: Mozilla Compliance Check

Example 8: STARTTLS Mail Server Scan

Example 9: sslyze STARTTLS Scan

Example 10: JSON Output for Automation

Example 11: Concurrent Multi-Target Scan

Example 12: Forward Secrecy Check

Example 13: RC4 Cipher Detection

Example 14: Mass Testing from File

Vulnerability Reference

Protocol Security Reference

testssl.sh Flag Reference

sslyze Flag Reference

Output Parsing

Parse testssl.sh JSON with jq

Parse sslyze JSON

Error Handling

Security Assessment Checklist

Critical (Must Fix)

High Priority

Medium Priority

Best Practices

References

Related skills

Frequently asked questions

How do I install the Ssl Check skill?

What does the Ssl Check skill do?

Is Ssl Check safe to use?

Which AI agents work with Ssl Check?

Is Ssl Check free to use?

Who published Ssl Check?