Lion Cipher Lab
Scan your server's TLS configuration for weaknesses with testssl.sh
- AppSec / DevSecOps
- Beginner
- ~45 min
- Free · no account required
Why it matters
A TLS certificate can be perfectly valid while the server around it is still misconfigured — accepting a decade-old protocol, offering a broken cipher, or exposing a named vulnerability. Those weaknesses do not show up as a browser warning; the padlock appears just the same. testssl.sh is the free, open-source tool that finds them: it opens the connections a careful attacker would, and hands you a colour-coded list of exactly what is weak and how badly. Being able to scan your own service, read the report, separate the genuinely dangerous findings from the cosmetic ones, and then fix the…
What you'll learn
- installing and running testssl.sh against a host you own
- recognising a TLS misconfiguration: deprecated protocols, weak ciphers, missing forward secrecy
- reading testssl.sh's colour-coded report and telling OK from WARN from CRITICAL
- spotting known-vulnerability findings such as Heartbleed and ROBOT
- prioritising high-severity findings instead of chasing every warning
- hardening a server: disabling old protocols and weak ciphers with a modern configuration
- understanding authorized testing — scan only your own hosts
Steps in this lab
- What a TLS misconfiguration is — and the one ground rule
- The weaknesses a TLS scan looks for
- Install testssl.sh (or run it with Docker)
- Run your first scan — against your own host
- Read the colour-coded report: OK, WARN, CRITICAL
- Focus on the high-severity findings first
- Fix it: disable old protocols and weak ciphers, apply a modern config
- What you learned — and why a clean scan is a baseline, not a guarantee