Skip to content

Commit f9edaa7

Browse files
committed
Phrasing of STARTTLS grading improved
... a a comment added in the desciption. Unfortunately I couldn't get the line wrapping working.
1 parent a20fd79 commit f9edaa7

File tree

1 file changed

+10
-2
lines changed

1 file changed

+10
-2
lines changed

testssl.sh

Lines changed: 10 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -22912,7 +22912,15 @@ run_rating() {
2291222912
pr_headlineln " Rating (experimental) "
2291322913
outln
2291422914

22915-
[[ -n "$STARTTLS_PROTOCOL" ]] && set_grade_cap "T" "Encryption via STARTTLS is not mandatory (opportunistic)."
22915+
[[ -n "$STARTTLS_PROTOCOL" ]] && set_grade_cap "T" "STARTTLS encryption is not mandatory for clients. STARTTLS can only be secured clientside"
22916+
22917+
# TL;DR: E-mail transfer via port 25 is broken and the amendments suggested so far are duct tape. So please do not expect testssl.sh to shut up.
22918+
22919+
# Explanation: For other than SMTP you should use TLS as per RFC 8314 . For SMTP however there's this thing named reality: A mail server cannot
22920+
# just switch to the mail submission port 587 only and continue to receive mail from everyone. Even if you advertise this via SRV record (RFC 6186).
22921+
# For STARTTLS there's no way to tell for testssl.sh whether it is secure. A MitM can always intercept the connection, unless the client checks
22922+
# the certificate accordingly (it's getting better but some just don't). TLSA Records/DANE and MTA-STS (RFC-8461) on the server side can help too.
22923+
# But as said, it's useless unless the client MTA checks all that which no tool can check.
2291622924

2291722925
pr_bold " Rating specs"; out " (not complete) "; outln "SSL Labs's 'SSL Server Rating Guide' (version 2009q from 2020-01-30)"
2291822926
pr_bold " Specification documentation "; pr_url "https://github.com/ssllabs/research/wiki/SSL-Server-Rating-Guide"
@@ -22965,7 +22973,7 @@ run_rating() {
2296522973
c1_worst=80
2296622974
elif [[ $(has_server_protocol "tls1") -eq 0 ]]; then
2296722975
c1_worst=90
22968-
elif [[ $(has_server_protocol "tls1_1") -eq 0 ]]; then
22976+
elif [[ $(as_server_protocol "tls1_1") -eq 0 ]]; then
2296922977
c1_worst=95
2297022978
else # TLS1.2 and TLS1.3 both give 100 points
2297122979
c1_worst=100

0 commit comments

Comments
 (0)