Skip to content

Commit 68cbdf8

Browse files
committed
Fix "off by one" error in HSTS
There was by mistake a 179 days threshold and also the error message was wrong when HSTS was exactly set to 179 days, see #1879. This commit sets it to 180 days and corrects the error messages on screen.
1 parent 835abd6 commit 68cbdf8

1 file changed

Lines changed: 3 additions & 3 deletions

File tree

testssl.sh

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -241,7 +241,7 @@ STARTTLS_SLEEP=${STARTTLS_SLEEP:-10} # max time wait on a socket for STARTTLS
241241
FAST_STARTTLS=${FAST_STARTTLS:-true} # at the cost of reliability decrease the handshakes for STARTTLS
242242
USLEEP_SND=${USLEEP_SND:-0.1} # sleep time for general socket send
243243
USLEEP_REC=${USLEEP_REC:-0.2} # sleep time for general socket receive
244-
HSTS_MIN=${HSTS_MIN:-179} # >179 days is ok for HSTS
244+
HSTS_MIN=${HSTS_MIN:-180} # >=180 days is ok for HSTS
245245
HSTS_MIN=$((HSTS_MIN * 86400)) # correct to seconds
246246
HPKP_MIN=${HPKP_MIN:-30} # >=30 days should be ok for HPKP_MIN, practical hints?
247247
HPKP_MIN=$((HPKP_MIN * 86400)) # correct to seconds
@@ -2424,11 +2424,11 @@ run_hsts() {
24242424
elif [[ $hsts_age_sec -eq 0 ]]; then
24252425
pr_svrty_low "HSTS max-age is set to 0. HSTS is disabled"
24262426
fileout "${jsonID}_time" "LOW" "0. HSTS is disabled"
2427-
elif [[ $hsts_age_sec -gt $HSTS_MIN ]]; then
2427+
elif [[ $hsts_age_sec -ge $HSTS_MIN ]]; then
24282428
pr_svrty_good "$hsts_age_days days" ; out "=$hsts_age_sec s"
24292429
fileout "${jsonID}_time" "OK" "$hsts_age_days days (=$hsts_age_sec seconds) > $HSTS_MIN seconds"
24302430
else
2431-
pr_svrty_medium "$hsts_age_sec s = $hsts_age_days days is too short ( >=$HSTS_MIN seconds recommended)"
2431+
pr_svrty_medium "$hsts_age_sec s = $hsts_age_days days is too short ( >= $HSTS_MIN seconds recommended)"
24322432
fileout "${jsonID}_time" "MEDIUM" "max-age too short. $hsts_age_days days (=$hsts_age_sec seconds) < $HSTS_MIN seconds"
24332433
fi
24342434
if includeSubDomains "$TMPFILE"; then

0 commit comments

Comments
 (0)