@passmarked/ssl
Advanced tools
Rules that relate to checking the SSL configuration of each individual resolved server from the domain to ensure locked down config with the broadest compatibility
Passmarked is a suite of tests that can be run against any page/website to identify issues with parity to most online tools in one package.
The Terminal Client is intended for use by developers to integrate into their workflow/CI servers but also integrate into their own application that might need to test websites and provide realtime feedback.
All of the checks on Passmarked can be voted on importance and are open-sourced, to encourage community involvement in fixing and adding new rules. We are building the living Web Standard and love any contributions.
The module firstly does a resolve on the DNS address (or just directly uses the single IP), and then runs the following tests again each of the resolved IP's:
The rules checked in this module are:
Firefox 1, Chrome 1, IE 7, Opera 5, Safari 1, Windows XP IE8, Android 2.3, Java 7.The rules are checked everytime a url is run through Passmarked or our API. To run using the hosted system head to passmarked.com or our Terminal Client use:
npm install -g passmarked
passmarked --filter=ssl example.com
The hosted version allows free runs from our homepage and the option to register a site to check in its entirety. Using the Passmarked npm module (or directly via the API) integrations are also possible to get running reports with all the rules in a matter of seconds.
CA Certs are loaded on startup, and the .crt used to read in the certificates can be configured using
CA_CERTS, the default is/etc/ssl/certs/ca-certificates.crt(for Ubuntu).
All rules can be run locally using our main integration library. This requires installing the package and any dependencies that the code might have such as a specific version of OpenSSL, see #dependencies
First ensure passmarked is installed:
npm install passmarked
npm install @passmarked/ssl
After which the rules will be runnable using promises:
passmarked.createRunner(
require('@passmarked/ssl'), // this package
require('@passmarked/ssl') // to test SSL
).run({
url: 'http://example.com',
body: 'body of page here',
har: {log: {entries: []}}
}).then(function(payload) {
if (payload.hasRule('secure')) {
console.log('better check that ...');
}
var rules = payload.getRules();
for (var rule in rules) {
console.log('*', rules[rule].getMessage());
}
}).catch(console.error.bind(console));
Alternatively, callbacks are also available:
passmarked.createRunner(
require('@passmarked/ssl'),
require('@passmarked/ssl'),
require('@passmarked/inspect')
).run({
url: 'http://example.com',
body: 'body of page here',
har: {log: {entries: []}}
}, function(err, payload) {
if (payload.hasRule('secure')) {
console.log("better check that ...");
}
var rules = payload.getRules();
for (var rule in rules) {
console.log('*', rules[rule].getMessage());
}
});
The module expects a updated version of OpenSSL, at the time of writing openssl-1.0.2h. The module expects the newest compiled excutable to present at /usr/local/ssl/bin/openssl.
# install our essentials to build openssl
apt-get install -y build-essential
# upgrade to a much newer and specific version of ssl
wget -O /tmp/openssl-1.0.2h.tar.gz https://www.openssl.org/source/openssl-1.0.2h.tar.gz
cd /tmp/ && tar -xf /tmp/openssl-1.0.2h.tar.gz
rm /tmp/openssl-1.0.2h.tar.gz
cd /tmp/openssl-1.0.2h && ./config
cd /tmp/openssl-1.0.2h && make depend
cd /tmp/openssl-1.0.2h && make
cd /tmp/openssl-1.0.2h && make install
rm -R /tmp/openssl-1.0.2h
We do also host a binary build for x86 Ubuntu over at package.passmarked.com/openssl/builds/openssl-x86-1.0.2h.bin that is mostly used for quick testing but would work if you require a quick way to get started.
The module also expects to see timeout from coreutils present in some form, this defaults to gtimeout on MacOS which can be installed using:
brew install coreutils
Also be sure to install the CA certificates and keep it updated, as these are used to check if a certificate is valid:
apt-get install -y ca-certificates
Rules represent checks that occur in this module, all of these rules have a UID which can be used to check for specific rules. For the structure and more details see the Wiki page on Rules.
Rules also include a
typewhich could becritical,error,warningornoticegiving a better view on the importance of the rule.
git clone git@github.com:passmarked/ssl.git
npm install
npm test
Pull requests have a prerequisite of passing tests. If your contribution is accepted, it will be merged into develop (and then master after staging tests by the team) which will then be deployed live to passmarked.com and on NPM for everyone to download and test.
To learn more visit:
Copyright 2016 Passmarked Inc
Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.
FAQs
Rules that relate to checking the SSL configuration of each individual resolved server from the domain to ensure locked down config with the broadest compatibility
The npm package @passmarked/ssl receives a total of 4 weekly downloads. As such, @passmarked/ssl popularity was classified as not popular.
We found that @passmarked/ssl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Bun 1.2.19 introduces isolated installs for smoother monorepo workflows, along with performance boosts, new tooling, and key compatibility fixes.
Security News
Popular npm packages like eslint-config-prettier were compromised after a phishing attack stole a maintainer’s token, spreading malicious updates.
Security News
/Research
A phishing attack targeted developers using a typosquatted npm domain (npnjs.com) to steal credentials via fake login pages - watch out for similar scams.