vapt-ssl

SSL/TLS & Cryptography Analysis

When Invoked

The user runs /vapt ssl <url> or this skill is triggered as part of Wave 1 during /vapt audit.

Phase 1: Certificate Analysis

1.1 Certificate Chain

If testssl.sh or testssl is installed:

testssl.sh --quiet --color 0 <domain>

Fallback (always run):

echo | openssl s_client -connect <domain>:443 -servername <domain> 2>/dev/null | openssl x509 -noout -text

Extract and analyze:

• Issuer: Who issued the cert (Let's Encrypt, DigiCert, self-signed?)
• Subject / SAN: What domains are covered
• Validity: Not Before / Not After — is it expired or expiring soon (<30 days)?
• Key Size: RSA 2048+ or ECDSA 256+? Anything below is weak
• Signature Algorithm: SHA-256 minimum. SHA-1 is broken.
• Certificate Chain: Is the full chain present? Missing intermediates?

1.2 Certificate Transparency

Check if certificate appears in CT logs (indicates proper issuance):

curl -s "https://crt.sh/?q=<domain>&output=json" | python3 -c "import sys,json; data=json.load(sys.stdin); print(f'{len(data)} certificates found in CT logs')"

Phase 2: Protocol & Cipher Analysis

2.1 Protocol Versions

If sslscan is installed:

sslscan --no-colour <domain>

Fallback:

# Test each protocol version
for proto in ssl3 tls1 tls1_1 tls1_2 tls1_3; do
    echo | openssl s_client -connect <domain>:443 -$proto 2>&1 | grep -q "CONNECTED" && echo "$proto: ENABLED" || echo "$proto: DISABLED"
done

Scoring:

Protocol	Status	Severity
SSLv3	Must be disabled	High (7.4) — POODLE
TLS 1.0	Should be disabled	Medium (5.9)
TLS 1.1	Should be disabled	Medium (5.3)
TLS 1.2	Must be enabled	OK
TLS 1.3	Should be enabled	Best practice

2.2 Cipher Suites

# List supported ciphers
nmap --script ssl-enum-ciphers -p 443 <domain>

Or with openssl:

openssl s_client -connect <domain>:443 -cipher 'ALL:eNULL' 2>/dev/null