User Tools
internet:security:ssl_tls_cert_testing
Differences
This shows you the differences between two versions of the page.
| Next revision | Previous revision | ||
|
internet:security:ssl_tls_cert_testing [2016/02/12 11:39] 127.0.0.1 external edit |
internet:security:ssl_tls_cert_testing [2022/03/22 08:46] (current) gcooper |
||
|---|---|---|---|
| Line 12: | Line 12: | ||
| |443 | |443 | ||
| |21 |FTP - TLS | | |21 |FTP - TLS | | ||
| - | |25 |Mail - TLS | | + | |25 |SMTP - TLS | |
| - | |465 |Mail - SSL | | + | |465 |SMTP - SSL | |
| - | |587 |Mail - TLS | | + | |587 |SMTP - TLS | |
| + | |993 |IMAP - SSL | | ||
| + | |995 |POP - SSL | ||
| |10000 | |10000 | ||
| |20000 | |20000 | ||
| Line 20: | Line 22: | ||
| ===== Web Tools ===== | ===== Web Tools ===== | ||
| - | Check Internet accessible hosts here: https:// | + | Check Internet accessible hosts here: |
| - | or here: http:// | + | https:// |
| + | |||
| + | https:// | ||
| + | |||
| + | http:// | ||
| ===== OpenSSL ===== | ===== OpenSSL ===== | ||
| Line 38: | Line 44: | ||
| </ | </ | ||
| - | This first test is the one that is easiest and should work from anywhere: | + | ==== Testing ==== |
| + | |||
| + | The OpenSSL toolkit allows checking SSL certificate installation on a server either remotely or locally. To check STARTTLS ports, run the following command replacing [port] with the port number and [protocol] with **smtp**, **pop3** or **imap** value (see the example below) respectively: | ||
| + | |||
| + | < | ||
| + | openssl s_client -connect example.com: | ||
| + | </ | ||
| + | |||
| + | The same command but without -starttls switch can be used for checking non-STARTTLS ports: | ||
| + | |||
| + | < | ||
| + | openssl s_client -connect example.com: | ||
| + | </ | ||
| + | |||
| + | This test is easiest and should work from anywhere: | ||
| < | < | ||
| Line 53: | Line 73: | ||
| < | < | ||
| - | openssl s_client -tls1 -crlf -showcerts -CAfile / | + | openssl s_client -tls1 -crlf -showcerts -CAfile / |
| </ | </ | ||
| Line 59: | Line 79: | ||
| < | < | ||
| - | openssl s_client -tls1 -crlf -showcerts -debug -CAfile / | + | openssl s_client -tls1 -crlf -showcerts -debug -CAfile / |
| + | </ | ||
| + | |||
| + | === Show Expiration Date === | ||
| + | |||
| + | Pipe the output of other '' | ||
| + | |||
| + | < | ||
| + | | openssl x509 -noout -enddate | ||
| + | </ | ||
| + | |||
| + | ==== SMTP and SMTPS ==== | ||
| + | |||
| + | < | ||
| + | openssl s_client -connect fqdn.hostname.tld: | ||
| + | |||
| + | openssl s_client -connect fqdn.hostname.tld: | ||
| + | |||
| + | openssl s_client -crlf -connect fqdn.hostname.tld: | ||
| </ | </ | ||
| Line 67: | Line 105: | ||
| < | < | ||
| - | curl -G -v --key / | + | curl -G -v --key / |
| + | </ | ||
| + | |||
| + | ===== Apache ===== | ||
| + | |||
| + | See how your Apache web server is configured for SSL: | ||
| + | |||
| + | < | ||
| + | grep -R SSL / | ||
| </ | </ | ||
| ===== Dovecot ===== | ===== Dovecot ===== | ||
| - | See how Dovecot is configured for SSL: | + | See how Dovecot is configured for SSL with one of these commands: |
| < | < | ||
| grep ssl / | grep ssl / | ||
| + | |||
| + | grep -R ssl / | ||
| </ | </ | ||
internet/security/ssl_tls_cert_testing.1455302345.txt.gz · Last modified: 2017/01/12 07:51 (external edit)
Page Tools
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
