There are so many tools such as testssl, sslyze to test the TLS configurations on webservers. I wanted to know, why aren't there any tool that checks the TLS client side? What makes it difficult?

  • 2
    The important TLS clients are browsers, and you just trust Google/Apple/Mozilla to test that. Tools like badssl.com/dashboard exist.
    – Z.T.
    Jul 31 '20 at 18:18

They are not difficult to check, it's just that TLS clients are lower priority to pentesters compared to servers. To check the client, e.g. for supported TLS versions, you would write a utility that starts the server with a TLS version (openssl s_server -accept 443 -tls1_1 -CAfile ca.pem -cert server.pem -key server.key), and examines traffic capture file for presence of "application data" string, which would indicate that the TLS handshake was a success.


It is unclear what you are trying to test exactly. But for browsers there is SSLLabs client test. One can also look at the ClientHello (contains all the supported ciphers, curves, hash algorithms ...).

... wanted to know,

For anything which needs multiple handshakes (like determining supported protocol versions) one has to somehow instrument the client to do multiple handshakes. While this is possible for web browsers by using JavaScript, there is no standard way for anything else. That's why one cannot write a universal tool which deeply tests behavior of arbitrary TLS clients.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.