Question

如何扫描和验证网站的TLS版本？

我正在寻找可以自动扫描我们公司中所有端点网站域的解决方案。 SSL实验室有一个手动的在线解决方案

https://www.ssllabs.com/ssltest/index.html

如何以编程方式实现此功能？

Answer 1

SSLLabsAPI似乎有效

using SslLabsLib.Enums;
using SslLabsLib;

public static void TLSChecker(string urlString)
{

    SslLabsClient client = new SslLabsClient();                                 
    // Get ipaddress and host
    var analysis = client.GetAnalysis(urlString, 24, AnalyzeOptions.Publish);
    Console.WriteLine(analysis.Host);            

    foreach (var item in analysis.Endpoints)
    {
        Console.WriteLine(item.IpAddress);

       var endpointanalysis = client.GetCachedEndpointAnalysis(analysis.Host, IPAddress.Parse(item.IpAddress));

        // get protocol list
        foreach (var protocol in endpointanalysis.Details.Protocols)
        {
            Console.WriteLine(protocol.Id);
            Console.WriteLine(protocol.Name);
            Console.WriteLine(protocol.Version);                    
        }                

    }

Answer 2

使用HttpClient ...强制其使用TLS 1.2 ...看看是否失败...获利。

public async Task<bool> SupportsTls12(string url)
{
    ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12;
    var client = new HttpClient();
    try
    {
        var response = await client.GetAsync(url);
        return true;
    }
    catch(HttpRequestException)
    {
        return false;
    }
}

如果您发现此错误/否定，则可能必须修改异常处理程序以检查返回的特定错误。但这是一般的想法。

如何扫描和验证网站的TLS版本？

2 个答案: