/ 
Monitoring-Sneck-Checks-0.0.2
/ Monitoring::Sneck::Checks::tls_protocols

NAME

Monitoring::Sneck::Checks::tls_protocols - checks what TLS versions a server takes

VERSION

Version 0.0.1

SYNOPSIS

www_tls|perl:tls_protocols -H www.example.org
mail_tls|perl:tls_protocols -H mail.example.org -s smtp -a TLSv1_2 -a TLSv1_3
ldaps_tls|perl:tls_protocols -H ldap.example.org -p 636 -r TLSv1 -r TLSv1_1 -r SSLv3

DESCRIPTION

Tries each TLS version given on its own, through IO::Socket::SSL. A version in --refuse that the server takes, or one in --accept that it does not, is CRITICAL.

Every version is tried with OpenSSL's security level set to 0, as otherwise this side would refuse the old ones, not the server. A version this host's OpenSSL can not do at all, as is common for SSLv3, is UNKNOWN, as it can not be told if the server takes it. So is not being able to connect, or STARTTLS failing, as nothing could be tried.

The certificate is not checked, see Monitoring::Sneck::Checks::https_cert for that. --starttls works the same as there.

OPTIONS

- -H, --hostname :: The host. Required.

- -p, --port :: The port. Default :: 443, or for --starttls, the protocol's

- -n, --sni :: The name to ask for. Default :: --hostname

- -s, --starttls :: Ask for TLS through smtp, imap, pop3, ftp, or ldap.

- --helo-name :: The name to give in EHLO, for --starttls smtp. Default :: the host name of this host

- -r, --refuse :: A version it must not take, SSLv3, TLSv1, TLSv1_1, TLSv1_2, or TLSv1_3. May be given more than once. Default :: TLSv1 and TLSv1_1, unless --accept is given

- -a, --accept :: A version it must take. May be given more than once.

METHODS

check

Does the check.

port

Returns the port, --port, or the default for --starttls, or 443.

try

Tries a version.

Returns 1 if the server takes it, 0 and why if not, or undef and why if it could not be tried, as for this host's OpenSSL not doing it, or not being able to connect at all.