Improve detection of missing SHA2 key exchange

internetstandards · Dec 9, 2024 · e9e1fd0 · e9e1fd0
1 parent 9bb6c41
commit e9e1fd0
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 3 deletions.
diff --git a/checks/tasks/tls/scans.py b/checks/tasks/tls/scans.py
@@ -14,7 +14,7 @@
 from cryptography.x509 import Certificate
 from django.conf import settings
 from nassl._nassl import OpenSSLError
-from nassl.ssl_client import ClientCertificateRequested
+from nassl.ssl_client import ClientCertificateRequested, OpenSslDigestNidEnum
 from sslyze import (
     ScanCommand,
     ServerScanRequest,
@@ -863,9 +863,15 @@ def test_key_exchange_hash(
 
     try:
         ssl_connection.connect()
+        if ssl_connection.ssl_client.get_peer_signature_nid() == OpenSslDigestNidEnum.SHA1:
+            log.info("Failed SHA2 key exchange check: negotiated SHA1 even when only offering SHA2")
+            return KeyExchangeHashFunctionEvaluation(
+                status=KexHashFuncStatus.bad,
+                score=scoring.WEB_TLS_KEX_HASH_FUNC_BAD,
+            )
     except ClientCertificateRequested:
         pass
-    except (ServerRejectedTlsHandshake, TlsHandshakeTimedOut) as exc:
+    except (ServerRejectedTlsHandshake, TlsHandshakeTimedOut, OpenSSLError) as exc:
         log.info(f"Failed SHA2 key exchange check: {exc}")
         return KeyExchangeHashFunctionEvaluation(
             status=KexHashFuncStatus.bad,

diff --git a/vendor/nassl6 b/vendor/nassl6
+15 −0		nassl/_nassl/nassl_SSL.c
+4 −0		nassl/ssl_client.py
+2 −0		tests/ssl_client_test.py