-
Notifications
You must be signed in to change notification settings - Fork 25
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
TLS grade having a hard time to update #58
Comments
We won't switch to SSLLabs (see #10 (comment)). You may try to bump the issue that got opened on cryptcheck if you want, it seems like there was no response for 2 years: aeris/cryptcheck#30 Or if you find an alternative that support x25519 curve for the handshake and is as good as cryptcheck then we can consider to switch to it. |
So I believe that SSL Labs API with a custom scoring engine (similar to cryptcheck) would be accepted as a solution (since it comes only to their grading policy). Correct? @unixfox |
Why not, if you are willing to contribute about it, we can try to implement this custom scoring engine. |
Alright. It is going to be an interesting python experience for me. Even though I know a theory it has never been my language of choice - wish me a good luck :-). Also currently my schedule is a little busy so I am not going to give any ETA on the contribution. Any suggestion to which repo should I make a pull request with my change? Or should it be a brand new project? |
If I'm not mistaken it is the same repo as you created the issue. No need for a separate repo if you are able to incorporate the custom scoring inside searx-stats2. Maybe @dalf will know more about this. |
Yes, you can fork this repository and follow the instructions in README.md The purpose is to change this cryptcheck_backend.py (and rename it). More precisely, and readling https://github.com/TrullJ/ssllabs/blob/master/ssllabsscanner.py and https://github.com/ssllabs/ssllabs-scan/blob/master/ssllabs-api-docs-v3.md, for each host:
In Currently, there are 2 call in parallel, see The output of You can make HTTP request: async with new_client() as session:
response = await session.get(api_url, timeout=HTTP_REQUEST_TIMEOUT) The You can check for one or few URL from the command line: Then you can check the output and / or the file |
@dalf That is a one, very detailed response. Thank you for that! It will help me for sure 😃. As I said, don't expect any pull requests yet. I still have a few things to work on. |
Hey @dalf I finally feel confident enough in my Python skills to take care of this issue. First of all, I have decided to use the https://github.com/devolo/ssllabs package as it seems to be the most actively maintained one. This package requires me to update the
After spending some time with the code I found out that dropping this function would break the Now I want to fill that missing details with the new The only issue I am having right now is that the dictionary structure is not very clear to me and it would help a lot (+save time) if you could simply provide me the cache/output file with dumped dictionary structure. This way when implementing certificate details I would be sure not to break any rendering on the I suppose it looks something like:
The full file would be very handy in making sure I have not made any mistakes and would help me to visualize things. |
Bump @dalf |
I'm sorry for long delay to answer.
See #10 (comment) About the SSL certificates, you are right. |
This is a follow up to #50.
So once again I am having an issue with my instance's TLS grade as apparently my ciphers are too modern. Talking about searx.monicz.pl here. And here is a result from cryptcheck itself: https://cryptcheck.fr/https/searx.monicz.pl
I believe this is related to me using x25519 curve for a handshake. And here is an issue posted on cryptcheck's repository: aeris/cryptcheck#30
+here are some extra TLS details from the ssllabs guys https://www.ssllabs.com/ssltest/analyze.html?d=searx.monicz.pl
A few words from me: x25519 is not an unusual curve to choose. It has been widely supported for a few good years now. From the ssllabs result you may find that my encryption is valid for all modern (and not) browsers like Chrome 69, Firefox 62.
My opinion is that cryptcheck is currently unable to process modern encryption thus an alternative should be found. Fortunately there are a few open-source projects which focus on bring ssllabs API to life. Learn more at https://www.ssllabs.com/projects/ssllabs-apis/index.html Some of them are developed in python so I believe that the implentation itself should not be a big of a hassle.
Ssllabs has been keeping up with the latest TLS improvements and vulnerabilities. I would say that it is a service of choice when it comes to testing your website's TLS configuration. And it also provides a TLS grading similar to cryptcheck's one.
The text was updated successfully, but these errors were encountered: