qsslcaudit

qsslcaudit is a tool designed to assess the security of applications using TLS/SSL for data transfers. It simulates various insecure server configurations to detect if clients accept weak or invalid certificates, outdated protocols, or low-strength ciphers.

Use cases include auditing custom applications, browsers, or services that rely on SSL/TLS to ensure they reject insecure configurations. This helps identify clients vulnerable to man-in-the-middle attacks, downgrade attacks, or exploitation via weak cryptography.

The tool provides comprehensive tests covering certificate validation flaws and protocol/cipher weaknesses, making it valuable for security testing in development and penetration testing environments.

qsslcaudit operates as a test server listening on a specified address and port, presenting custom certificates, self-signed certs, or weak protocol/cipher combinations to connecting SSL/TLS clients. It runs predefined tests (1-29) that check client behavior against insecure setups, such as trusting self-signed certificates for invalid domains, supporting SSLv2/SSLv3, or accepting EXPORT/LOW/MEDIUM grade ciphers across TLS/DTLS versions. Tests like CVE-2020-0601 evaluate specific vulnerabilities in ECC certificate trust.