sys-cmd sslscan

sys-cmd sslscan connects one after another to a TLS server from the route table selected in WEB-CLI and lists which protocol versions and cipher suites it accepts, the cipher suite it prefers and the details of the certificate it offers. It is used to verify the TLS configuration of a vService or a backend from the outside.

Command Summary

TR7 WEB-CLI · sys-cmd sslscan

# type sslscan and press Tab: a free parameter

admin@TR7LBWAF01> sys-cmd sslscan

<sslscan-parameter-1>

 

admin@TR7LBWAF01> sys-cmd sslscan <parameters> <target>:<port>

admin@TR7LBWAF01>  

Everything written after the word sslscan is passed to the tool as it is. There is no mandatory field; the target is written in the address:port form, and if a port is not written, 443 is assumed.

How It Works

Subject	Behavior
Context	The connections are established from within the selected v-device and route table.
Load	It tries a separate handshake for every version and cipher suite; a large number of connections occurs on the target in a short time.
Duration	It closes by itself when the scan finishes.
Pipe	The output can be filtered with | or written to a file with to-file.
Recording	Every run is written to the user logs.

Frequently Used Parameters

Parameter	What it does	What is written after it
--sni-name=	Determines the server name to be sent in the handshake; for seeing the correct certificate on vServices that offer more than one certificate on the same address	A domain name, adjacent to =
--show-certificate	Writes all the details of the certificate that is offered	—
--no-ciphersuites	Skips the cipher suite list	—
--tls12 · --tls13	Tries only the specified TLS version	—
--no-colour	Turns off the colored output; it increases readability when writing to a file	—

The table summarizes the frequently used ones; the full list and the parameter names depend on the version of the tool on the device.

Examples

TR7 WEB-CLI · A) The TLS versions and cipher suites of the VIP

admin@TR7LBWAF01> sys-cmd sslscan 10.0.7.20:443

admin@TR7LBWAF01>  

TR7 WEB-CLI · B) The certificate of a specific domain name

admin@TR7LBWAF01> sys-cmd sslscan --sni-name=app.example.com --show-certificate --no-ciphersuites 10.0.7.20:443

admin@TR7LBWAF01>  

TR7 WEB-CLI · C) The TLS 1.3 support of the backend

admin@TR7LBWAF01> sys-cmd sslscan --tls13 10.20.0.30:8443

admin@TR7LBWAF01>  

TR7 WEB-CLI · D) Write the result to a file

admin@TR7LBWAF01> sys-cmd sslscan --no-colour 10.0.7.20:443 | to-file vip-tls.txt

admin@TR7LBWAF01>  

Things to Know

• The wrong certificate appears. If more than one domain name is offered on the same address, a scan made without sending a server name shows the default certificate; the correct name is sent with --sni-name=.
• Production load. Because the scan opens a large number of short connections, it is not run one after another against a live VIP during busy hours.
• The TLS settings on the vService side come from lb ssl-security and from the certificate assignments; the scan result is compared with these settings.
• To see the flow of the connection step by step, ssldump is used.