About

Imported from sohan-a11y/Ageis-AI-Pentester (xalgorix-main/internal/tools/skills/data/network-security/performing-ssl-tls-security-assessment/SKILL.md). Install upstream with npx skills add sohan-a11y/Ageis-AI-Pentester --skill performing-ssl-tls-security-assessment. Copyright stays with the author (Apache-2.0).

Performing SSL/TLS Security Assessment

Name: performing-ssl-tls-security-assessment
Author: sohan-a11y

Overview

Assess SSL/TLS server configurations using sslyze, a fast Python-based scanning library. This skill covers evaluating supported protocol versions (SSLv2/3, TLS 1.0-1.3), cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and scanning for known vulnerabilities including Heartbleed, ROBOT, and session renegotiation weaknesses.

When to Use

When conducting security assessments that involve performing ssl tls security assessment
When following incident response procedures for related security events
When performing scheduled security testing or auditing activities
When validating security controls through hands-on testing

Most Often Missed & How to Confirm

SNI and vhosts: scanning the IP without -servername/SNI returns the default vhost's cert and ciphers, not the target's. Always set SNI (openssl s_client -connect host:443 -servername host; sslyze uses the hostname) or you assess the wrong service.
Beyond 443: STARTTLS services (SMTP 25/587, IMAP 143, POP3 110, LDAP 389, FTPS, MySQL, PostgreSQL) need explicit STARTTLS probing — testssl.sh --starttls smtp host:587. A 443-only scan misses them entirely.
Full protocol/cipher matrix: don't stop at "TLS 1.2 supported" — enumerate SSLv2/SSLv3/TLS1.0/1.1 still enabled, weak ciphers (RC4, 3DES, EXPORT, NULL, CBC), and cipher order/forward secrecy. One accepted legacy protocol is the finding.
Cert chain and trust: check the full chain order, intermediate completeness, expiry, SAN coverage, and signature algorithm. A leaf that validates in a browser may still ship an incomplete chain that breaks non-browser clients.
Vuln checks need the precondition: Heartbleed needs the heartbeat extension; ROBOT needs RSA key exchange. Flag only after the specific check confirms it, never from version alone.
How to confirm a hit: corroborate sslyze with testssl.sh and a manual openssl s_client -cipher 'RC4' -tls1 handshake that actually completes — a completed handshake on a weak protocol/cipher is the proof; a lone scanner line is a candidate.
Don't conclude "secure" until you've tested every TLS-bearing port, set SNI, and checked STARTTLS plus the legacy-protocol matrix.

Prerequisites

Python 3.9+ with sslyze library (pip install sslyze)
Network access to target HTTPS servers on port 443
Understanding of TLS protocol versions and cipher suite classifications

Steps

Step 1: Configure Server Scan

Create ServerScanRequest with ServerNetworkLocation specifying target hostname and port.

Step 2: Execute TLS Scan

Use sslyze Scanner to queue and execute scans for all TLS check commands concurrently.

Step 3: Analyze Results

Evaluate accepted cipher suites, certificate validity, protocol versions, and vulnerability scan results.

Step 4: Generate Security Report

Produce a JSON report with compliance findings and remediation recommendations.

Expected Output

JSON report with supported protocols, accepted cipher suites, certificate details, vulnerability results (Heartbleed, ROBOT), and HSTS status.

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml

targets:
  - https://api.opensmartroute.ai/api/v1/registry/sohan-a11y-ageis-ai-pentester-performing-ssl-tls-securit-99aeb3/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

sohan-a11y-ageis-ai-pentester-performing-ssl-tls-securit-99aeb3.ocm.jsonjson

{
  "ocm": "1",
  "id": "sohan-a11y-ageis-ai-pentester-performing-ssl-tls-securit-99aeb3",
  "kind": "skill",
  "name": "performing-ssl-tls-security-assessment",
  "description": "Assess SSL/TLS server configurations using the sslyze Python library to evaluate cipher suites, certificate chains, protocol versions, HSTS headers, and known vulnerabilities like Heartbleed and ROBOT.",
  "publisher": "sohan-a11y",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "network-security",
      "ssl",
      "tls",
      "sslyze",
      "certificate",
      "cipher-suites",
      "vulnerability-assessment",
      "github"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Assess SSL/TLS server configurations using the sslyze Python library to evaluate cipher suites, certificate chains, protocol versions, HSTS headers, and known vulnerabilities like Heartbleed and ROBOT."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "github",
      "repository": "https://github.com/sohan-a11y/Ageis-AI-Pentester",
      "path": "xalgorix-main/internal/tools/skills/data/network-security/performing-ssl-tls-security-assessment/SKILL.md",
      "ref": "b2af7247d8cff0a96860b7f031d5d8c648ac91c1",
      "url": "https://github.com/sohan-a11y/Ageis-AI-Pentester/blob/b2af7247d8cff0a96860b7f031d5d8c648ac91c1/xalgorix-main/internal/tools/skills/data/network-security/performing-ssl-tls-security-assessment/SKILL.md",
      "key": "sohan-a11y/Ageis-AI-Pentester/xalgorix-main/internal/tools/skills/data/network-security/performing-ssl-tls-security-assessment/SKILL.md"
    },
    "license": "Apache-2.0"
  },
  "instructions": "# Performing SSL/TLS Security Assessment\n\n## Overview\n\nAssess SSL/TLS server configurations using sslyze, a fast Python-based scanning library. This skill covers evaluating supported protocol versions (SSLv2/3, TLS 1.0-1.3), cipher suite strength, certificate chain validation, HSTS enforcement, OCSP stapling, and scanning for known vulnerabilities including Heartbleed, ROBOT, and session renegotiation weaknesses.\n\n\n## When to Use\n\n- When conducting security assessments that involve performing ssl tls security assessment\n- When following incident response procedures for related security events\n",
  "cost": {
    "context_tokens": 791
  }
}

Fetch it by URL: GET /api/v1/registry/sohan-a11y-ageis-ai-pentester-performing-ssl-tls-securit-99aeb3/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.