0000: 23 20 47 72 6f 75 70 2c 4e 61 6d 65 2c 43 6f 6e # Group,Name,Con
0010: 73 74 72 61 69 6e 74 73 2c 53 65 74 75 70 2c 42 straints,Setup,B
0020: 6f 64 79 2c 43 6c 65 61 6e 75 70 2c 4d 61 74 63 ody,Cleanup,Matc
0030: 68 2c 52 65 73 75 6c 74 2c 4f 75 74 70 75 74 2c h,Result,Output,
0040: 45 72 72 6f 72 20 4f 75 74 70 75 74 2c 52 65 74 Error Output,Ret
0050: 75 72 6e 20 43 6f 64 65 73 0a 63 6f 6d 6d 61 6e urn Codes.comman
0060: 64 2c 70 61 63 6b 61 67 65 20 70 72 65 66 65 72 d,package prefer
0070: 20 6c 61 74 65 73 74 2c 2c 2c 2c 2c 2c 2c 2c 2c latest,,,,,,,,,
0080: 0a 63 6f 6d 6d 61 6e 64 2c 70 61 63 6b 61 67 65 .command,package
0090: 20 72 65 71 75 69 72 65 20 74 6c 73 2c 2c 2c 2c require tls,,,,
00a0: 2c 2c 2c 2c 2c 0a 2c 2c 2c 2c 2c 2c 2c 2c 2c 2c ,,,,,.,,,,,,,,,,
00b0: 0a 63 6f 6d 6d 61 6e 64 2c 23 20 43 6f 6e 73 74 .command,# Const
00c0: 72 61 69 6e 74 73 2c 2c 2c 2c 2c 2c 2c 2c 2c 0a raints,,,,,,,,,.
00d0: 63 6f 6d 6d 61 6e 64 2c 73 6f 75 72 63 65 20 5b command,source [
00e0: 66 69 6c 65 20 6a 6f 69 6e 20 5b 66 69 6c 65 20 file join [file
00f0: 64 69 72 6e 61 6d 65 20 5b 69 6e 66 6f 20 73 63 dirname [info sc
0100: 72 69 70 74 5d 5d 20 63 6f 6d 6d 6f 6e 2e 74 63 ript]] common.tc
0110: 6c 5d 2c 2c 2c 2c 2c 2c 2c 2c 2c 0a 2c 2c 2c 2c l],,,,,,,,,.,,,,
0120: 2c 2c 2c 2c 2c 2c 0a 63 6f 6d 6d 61 6e 64 2c 23 ,,,,,,.command,#
0130: 20 48 65 6c 70 65 72 20 66 75 6e 63 74 69 6f 6e Helper function
0140: 73 2c 2c 2c 2c 2c 2c 2c 2c 2c 0a 63 6f 6d 6d 61 s,,,,,,,,,.comma
0150: 6e 64 2c 22 70 72 6f 63 20 63 6f 6e 6e 65 63 74 nd,"proc connect
0160: 20 7b 75 72 6c 7d 20 7b 0a 20 20 20 20 73 65 74 {url} {. set
0170: 20 70 6f 72 74 20 34 34 33 0a 20 20 20 20 6c 61 port 443. la
0180: 73 73 69 67 6e 20 5b 73 70 6c 69 74 20 24 75 72 ssign [split $ur
0190: 6c 20 22 22 3a 22 22 5d 20 75 72 6c 20 70 6f 72 l "":""] url por
01a0: 74 0a 20 20 20 20 69 66 20 7b 24 70 6f 72 74 20 t. if {$port
01b0: 65 71 20 22 22 22 22 7d 20 7b 0a 20 73 65 74 20 eq """"} {. set
01c0: 70 6f 72 74 20 34 34 33 0a 20 20 20 20 7d 0a 20 port 443. }.
01d0: 20 20 20 73 65 74 20 63 6d 64 20 5b 6c 69 73 74 set cmd [list
01e0: 20 74 6c 73 3a 3a 73 6f 63 6b 65 74 20 2d 61 75 tls::socket -au
01f0: 74 6f 73 65 72 76 65 72 6e 61 6d 65 20 31 20 2d toservername 1 -
0200: 72 65 71 75 69 72 65 20 31 5d 0a 20 20 20 20 69 require 1]. i
0210: 66 20 7b 5b 69 6e 66 6f 20 65 78 69 73 74 73 20 f {[info exists
0220: 3a 3a 65 6e 76 28 53 53 4c 5f 43 45 52 54 5f 46 ::env(SSL_CERT_F
0230: 49 4c 45 29 5d 7d 20 7b 0a 20 6c 61 70 70 65 6e ILE)]} {. lappen
0240: 64 20 63 6d 64 20 2d 63 61 66 69 6c 65 20 24 3a d cmd -cafile $:
0250: 3a 65 6e 76 28 53 53 4c 5f 43 45 52 54 5f 46 49 :env(SSL_CERT_FI
0260: 4c 45 29 0a 20 20 20 20 7d 0a 20 20 20 20 6c 61 LE). }. la
0270: 70 70 65 6e 64 20 63 6d 64 20 24 75 72 6c 20 24 ppend cmd $url $
0280: 70 6f 72 74 0a 20 20 20 20 73 65 74 20 63 68 20 port. set ch
0290: 5b 65 76 61 6c 20 24 63 6d 64 5d 0a 20 20 20 20 [eval $cmd].
02a0: 69 66 20 7b 5b 63 61 74 63 68 20 7b 74 6c 73 3a if {[catch {tls:
02b0: 3a 68 61 6e 64 73 68 61 6b 65 20 24 63 68 7d 20 :handshake $ch}
02c0: 65 72 72 5d 7d 20 7b 0a 20 63 6c 6f 73 65 20 24 err]} {. close $
02d0: 63 68 0a 20 72 65 74 75 72 6e 20 2d 63 6f 64 65 ch. return -code
02e0: 20 65 72 72 6f 72 20 24 65 72 72 0a 20 20 20 20 error $err.
02f0: 7d 20 65 6c 73 65 20 7b 0a 20 63 6c 6f 73 65 20 } else {. close
0300: 24 63 68 0a 20 20 20 20 7d 0a 7d 0a 22 2c 2c 2c $ch. }.}.",,,
0310: 2c 2c 2c 2c 2c 2c 0a 2c 2c 2c 2c 2c 2c 2c 2c 2c ,,,,,,.,,,,,,,,,
0320: 2c 0a 63 6f 6d 6d 61 6e 64 2c 23 20 63 6c 69 65 ,.command,# clie
0330: 6e 74 74 65 73 74 2e 73 73 6c 6c 61 62 73 2e 63 nttest.ssllabs.c
0340: 6f 6d 20 54 65 73 74 73 2c 2c 2c 2c 2c 2c 2c 2c om Tests,,,,,,,,
0350: 2c 0a 53 53 4c 4c 61 62 73 2c 43 56 45 2d 32 30 ,.SSLLabs,CVE-20
0360: 32 30 2d 30 36 30 31 20 28 43 75 72 76 65 42 61 20-0601 (CurveBa
0370: 6c 6c 29 20 56 75 6c 6e 65 72 61 62 69 6c 69 74 ll) Vulnerabilit
0380: 79 2c 77 69 6e 20 4f 70 65 6e 53 53 4c 31 2e 31 y,win OpenSSL1.1
0390: 2e 31 2c 2c 63 6f 6e 6e 65 63 74 20 77 77 77 2e .1,,connect www.
03a0: 73 73 6c 6c 61 62 73 2e 63 6f 6d 3a 31 30 34 34 ssllabs.com:1044
03b0: 36 2c 2c 2c 22 68 61 6e 64 73 68 61 6b 65 20 66 6,,,"handshake f
03c0: 61 69 6c 65 64 3a 20 63 65 72 74 69 66 69 63 61 ailed: certifica
03d0: 74 65 20 76 65 72 69 66 79 20 66 61 69 6c 65 64 te verify failed
03e0: 20 64 75 65 20 74 6f 20 22 22 73 65 6c 66 20 73 due to ""self s
03f0: 69 67 6e 65 64 20 63 65 72 74 69 66 69 63 61 74 igned certificat
0400: 65 20 69 6e 20 63 65 72 74 69 66 69 63 61 74 65 e in certificate
0410: 20 63 68 61 69 6e 22 22 22 2c 2c 2c 31 0a 53 53 chain""",,,1.SS
0420: 4c 4c 61 62 73 2c 43 56 45 2d 32 30 32 30 2d 30 LLabs,CVE-2020-0
0430: 36 30 31 20 28 43 75 72 76 65 42 61 6c 6c 29 20 601 (CurveBall)
0440: 56 75 6c 6e 65 72 61 62 69 6c 69 74 79 2c 77 69 Vulnerability,wi
0450: 6e 20 21 4f 70 65 6e 53 53 4c 31 2e 31 2e 31 2c n !OpenSSL1.1.1,
0460: 2c 63 6f 6e 6e 65 63 74 20 77 77 77 2e 73 73 6c ,connect www.ssl
0470: 6c 61 62 73 2e 63 6f 6d 3a 31 30 34 34 36 2c 2c labs.com:10446,,
0480: 2c 22 68 61 6e 64 73 68 61 6b 65 20 66 61 69 6c ,"handshake fail
0490: 65 64 3a 20 63 65 72 74 69 66 69 63 61 74 65 20 ed: certificate
04a0: 76 65 72 69 66 79 20 66 61 69 6c 65 64 20 64 75 verify failed du
04b0: 65 20 74 6f 20 22 22 73 65 6c 66 2d 73 69 67 6e e to ""self-sign
04c0: 65 64 20 63 65 72 74 69 66 69 63 61 74 65 20 69 ed certificate i
04d0: 6e 20 63 65 72 74 69 66 69 63 61 74 65 20 63 68 n certificate ch
04e0: 61 69 6e 22 22 22 2c 2c 2c 31 0a 53 53 4c 4c 61 ain""",,,1.SSLLa
04f0: 62 73 2c 43 56 45 2d 32 30 32 30 2d 30 36 30 31 bs,CVE-2020-0601
0500: 20 28 43 75 72 76 65 42 61 6c 6c 29 20 56 75 6c (CurveBall) Vul
0510: 6e 65 72 61 62 69 6c 69 74 79 2c 6d 61 63 2c 2c nerability,mac,,
0520: 63 6f 6e 6e 65 63 74 20 77 77 77 2e 73 73 6c 6c connect www.ssll
0530: 61 62 73 2e 63 6f 6d 3a 31 30 34 34 36 2c 2c 2c abs.com:10446,,,
0540: 22 68 61 6e 64 73 68 61 6b 65 20 66 61 69 6c 65 "handshake faile
0550: 64 3a 20 63 65 72 74 69 66 69 63 61 74 65 20 76 d: certificate v
0560: 65 72 69 66 79 20 66 61 69 6c 65 64 20 64 75 65 erify failed due
0570: 20 74 6f 20 22 22 73 65 6c 66 2d 73 69 67 6e 65 to ""self-signe
0580: 64 20 63 65 72 74 69 66 69 63 61 74 65 20 69 6e d certificate in
0590: 20 63 65 72 74 69 66 69 63 61 74 65 20 63 68 61 certificate cha
05a0: 69 6e 22 22 22 2c 2c 2c 31 0a 53 53 4c 4c 61 62 in""",,,1.SSLLab
05b0: 73 2c 43 56 45 2d 32 30 32 30 2d 30 36 30 31 20 s,CVE-2020-0601
05c0: 28 43 75 72 76 65 42 61 6c 6c 29 20 56 75 6c 6e (CurveBall) Vuln
05d0: 65 72 61 62 69 6c 69 74 79 2c 75 6e 69 78 20 21 erability,unix !
05e0: 6d 61 63 2c 2c 63 6f 6e 6e 65 63 74 20 77 77 77 mac,,connect www
05f0: 2e 73 73 6c 6c 61 62 73 2e 63 6f 6d 3a 31 30 34 .ssllabs.com:104
0600: 34 36 2c 2c 2c 22 68 61 6e 64 73 68 61 6b 65 20 46,,,"handshake
0610: 66 61 69 6c 65 64 3a 20 64 65 63 6f 64 65 20 65 failed: decode e
0620: 72 72 6f 72 20 64 75 65 20 74 6f 20 22 22 75 6e rror due to ""un
0630: 61 62 6c 65 20 74 6f 20 67 65 74 20 6c 6f 63 61 able to get loca
0640: 6c 20 69 73 73 75 65 72 20 63 65 72 74 69 66 69 l issuer certifi
0650: 63 61 74 65 22 22 22 2c 2c 2c 31 0a 53 53 4c 4c cate""",,,1.SSLL
0660: 61 62 73 2c 4c 6f 67 6a 61 6d 20 56 75 6c 6e 65 abs,Logjam Vulne
0670: 72 61 62 69 6c 69 74 79 2c 77 69 6e 20 4f 70 65 rability,win Ope
0680: 6e 53 53 4c 33 2e 30 2c 2c 63 6f 6e 6e 65 63 74 nSSL3.0,,connect
0690: 20 77 77 77 2e 73 73 6c 6c 61 62 73 2e 63 6f 6d www.ssllabs.com
06a0: 3a 31 30 34 34 35 2c 2c 2c 22 68 61 6e 64 73 68 :10445,,,"handsh
06b0: 61 6b 65 20 66 61 69 6c 65 64 3a 20 63 65 72 74 ake failed: cert
06c0: 69 66 69 63 61 74 65 20 76 65 72 69 66 79 20 66 ificate verify f
06d0: 61 69 6c 65 64 20 64 75 65 20 74 6f 20 22 22 75 ailed due to ""u
06e0: 6e 61 62 6c 65 20 74 6f 20 67 65 74 20 6c 6f 63 nable to get loc
06f0: 61 6c 20 69 73 73 75 65 72 20 63 65 72 74 69 66 al issuer certif
0700: 69 63 61 74 65 22 22 22 2c 2c 2c 31 0a 53 53 4c icate""",,,1.SSL
0710: 4c 61 62 73 2c 4c 6f 67 6a 61 6d 20 56 75 6c 6e Labs,Logjam Vuln
0720: 65 72 61 62 69 6c 69 74 79 2c 75 6e 69 78 20 4f erability,unix O
0730: 70 65 6e 53 53 4c 33 2e 30 2c 2c 63 6f 6e 6e 65 penSSL3.0,,conne
0740: 63 74 20 77 77 77 2e 73 73 6c 6c 61 62 73 2e 63 ct www.ssllabs.c
0750: 6f 6d 3a 31 30 34 34 35 2c 2c 2c 68 61 6e 64 73 om:10445,,,hands
0760: 68 61 6b 65 20 66 61 69 6c 65 64 3a 20 64 68 20 hake failed: dh
0770: 6b 65 79 20 74 6f 6f 20 73 6d 61 6c 6c 2c 2c 2c key too small,,,
0780: 31 0a 53 53 4c 4c 61 62 73 2c 4c 6f 67 6a 61 6d 1.SSLLabs,Logjam
0790: 20 56 75 6c 6e 65 72 61 62 69 6c 69 74 79 2c 77 Vulnerability,w
07a0: 69 6e 20 4f 70 65 6e 53 53 4c 33 2e 32 2c 2c 63 in OpenSSL3.2,,c
07b0: 6f 6e 6e 65 63 74 20 77 77 77 2e 73 73 6c 6c 61 onnect www.sslla
07c0: 62 73 2e 63 6f 6d 3a 31 30 34 34 35 2c 2c 2c 68 bs.com:10445,,,h
07d0: 61 6e 64 73 68 61 6b 65 20 66 61 69 6c 65 64 3a andshake failed:
07e0: 20 75 6e 6b 6e 6f 77 6e 20 73 65 63 75 72 69 74 unknown securit
07f0: 79 20 62 69 74 73 2c 2c 2c 31 0a 53 53 4c 4c 61 y bits,,,1.SSLLa
0800: 62 73 2c 4c 6f 67 6a 61 6d 20 56 75 6c 6e 65 72 bs,Logjam Vulner
0810: 61 62 69 6c 69 74 79 2c 75 6e 69 78 20 21 6d 61 ability,unix !ma
0820: 63 20 4f 70 65 6e 53 53 4c 33 2e 32 2c 2c 63 6f c OpenSSL3.2,,co
0830: 6e 6e 65 63 74 20 77 77 77 2e 73 73 6c 6c 61 62 nnect www.ssllab
0840: 73 2e 63 6f 6d 3a 31 30 34 34 35 2c 2c 2c 68 61 s.com:10445,,,ha
0850: 6e 64 73 68 61 6b 65 20 66 61 69 6c 65 64 3a 20 ndshake failed:
0860: 75 6e 6b 6e 6f 77 6e 20 73 65 63 75 72 69 74 79 unknown security
0870: 20 62 69 74 73 2c 2c 2c 31 0a 53 53 4c 4c 61 62 bits,,,1.SSLLab
0880: 73 2c 4c 6f 67 6a 61 6d 20 56 75 6c 6e 65 72 61 s,Logjam Vulnera
0890: 62 69 6c 69 74 79 2c 6d 61 63 20 4f 70 65 6e 53 bility,mac OpenS
08a0: 53 4c 33 2e 32 2c 2c 63 6f 6e 6e 65 63 74 20 77 SL3.2,,connect w
08b0: 77 77 2e 73 73 6c 6c 61 62 73 2e 63 6f 6d 3a 31 ww.ssllabs.com:1
08c0: 30 34 34 35 2c 2c 2c 22 68 61 6e 64 73 68 61 6b 0445,,,"handshak
08d0: 65 20 66 61 69 6c 65 64 3a 20 63 65 72 74 69 66 e failed: certif
08e0: 69 63 61 74 65 20 76 65 72 69 66 79 20 66 61 69 icate verify fai
08f0: 6c 65 64 20 64 75 65 20 74 6f 20 22 22 75 6e 61 led due to ""una
0900: 62 6c 65 20 74 6f 20 67 65 74 20 6c 6f 63 61 6c ble to get local
0910: 20 69 73 73 75 65 72 20 63 65 72 74 69 66 69 63 issuer certific
0920: 61 74 65 22 22 22 2c 2c 2c 31 0a 53 53 4c 4c 61 ate""",,,1.SSLLa
0930: 62 73 2c 46 52 45 41 4b 20 56 75 6c 6e 65 72 61 bs,FREAK Vulnera
0940: 62 69 6c 69 74 79 2c 2c 2c 63 6f 6e 6e 65 63 74 bility,,,connect
0950: 20 77 77 77 2e 73 73 6c 6c 61 62 73 2e 63 6f 6d www.ssllabs.com
0960: 3a 31 30 34 34 34 2c 2c 2c 68 61 6e 64 73 68 61 :10444,,,handsha
0970: 6b 65 20 66 61 69 6c 65 64 3a 20 75 6e 73 75 70 ke failed: unsup
0980: 70 6f 72 74 65 64 20 70 72 6f 74 6f 63 6f 6c 2c ported protocol,
0990: 2c 2c 31 0a 53 53 4c 4c 61 62 73 2c 50 4f 4f 44 ,,1.SSLLabs,POOD
09a0: 4c 45 20 56 75 6c 6e 65 72 61 62 69 6c 69 74 79 LE Vulnerability
09b0: 2c 2c 2c 63 6f 6e 6e 65 63 74 20 77 77 77 2e 73 ,,,connect www.s
09c0: 73 6c 6c 61 62 73 2e 63 6f 6d 3a 31 30 34 34 33 sllabs.com:10443
09d0: 2c 2c 2c 68 61 6e 64 73 68 61 6b 65 20 66 61 69 ,,,handshake fai
09e0: 6c 65 64 3a 20 75 6e 73 75 70 70 6f 72 74 65 64 led: unsupported
09f0: 20 70 72 6f 74 6f 63 6f 6c 2c 2c 2c 31 0a protocol,,,1.