►
From YouTube: PowerShell Lightning Talk: Automating SSLabs testing using PowerShell with Clem Messerli
Description
Clem Messerli demos a script he wrote to automate the testing of a website SSL settings. The script leverages the SSLabs API to test websites from the command line.
Clem walks through why he is using the various settings that he added to his script. This is an excellent example of how API's can be leveraged to automate a task and query for certain suspect security settings.
Research Triangle PowerShell Users Group (RTPSUG) is the largest PowerShell group in the world! We meet twice a month to discuss all topics related to PowerShell and automation. Our topics cover beginner to advanced concepts and offer people a chance to learn new skills and ask questions. One of the foundations that we live by is to create a space to for all to attendees to feel welcome, have a chance to ask questions and be part of a community. For more information on our group, please visit any of following links:
WEB: https://rtpsug.com
MEETUP: https://www.meetup.com/Research-Triangle-PowerShell-Users-Group
LINKEDIN: https://www.linkedin.com/company/rtpsug/
TWITTER: https://twitter.com/rtpsug
GITHUB: https://github.com/rtpsug
A
A
Women,
this
is
the
typical
SSL
labs
and
it's
the
free
open-source
online
site
that
you
can
use.
It
does
have
a
few
limitations.
You
can
only
test
like
four
four
three
sites
and
you
have
to
use
the
fqdn.
You
can't
test
by
IP
address,
but
this
is
sort
of
a
typical
grade
score
and
we
use
this
a
lot
to
kind
of
baseline,
some
of
our
external
sites,
to
make
sure
that
our
TLS
settings
cipher
suites
things
like
that
are
okay,
I'm,
showing
what
will
become
the
future
blogspot.
A
Last
week,
I
just
got
a
Hugo
working
so
that
I
can
start
doing
some
blogging
and
try
and
get
back
to
the
community.
So
there
will
be
more
content
coming
here
right
now.
You
can
obviously
see
I
have
just
the
hello
world,
but
back
to
the
code,
punched
in
basically,
what
I
like
to
do
is
I
like
to
take
the
parameters
that
the
API
provides
and
make
sure
that
I
can
pass
those
in
and
override
them
as
a
function.
A
Most
of
the
time,
I
will
leave
these
as
the
default
to
what
they
have.
You
can
see
that
within
their
API
you
can
set
a
sleep
timer,
a
max
age.
If
you
want
to
if
you're,
okay
grabbing
like
cached
results.
Let's
say
somebody
has
scanned
that
site
in
the
last
hour,
if
I
run
the
API
call,
it's
not
gonna
run
it
afresh.
A
Scanned
it'll
just
use
the
cache
data
and
you
can
override
that
publish
is
whether
you
want
to
put
it
on
their
site
as
a
public
site
and
publish
on
and
off
pretty
straightforward
start
new
is
a
switch
to
and
I
passed
it
in
as
a
string.
Just
because
that's
what
their
API
is
is
expecting,
but
it's
basically
a
switch
to
tell
the
SSL
labs
API,
whether
or
not
you
want
to
force
a
fresh
scan,
even
if
it's
within
the
new
max
age
that
you
may
have
said,
or
that
may
be
cached.
A
A
There
is
a
start
new
equals
flag,
they
the
API.
They
only
want
you
to
do
that
the
first
time
and
then
after
that
they
want
you
to
just
query
intermittently
for
the
results.
So
I
go
ahead
and
I
do
that
down
here
in
a
while
loop
and
within
the
API,
when
you
call
it
the
first
time
I'll
set
a
sleep,
timer
wait.
10
seconds
start
the
while
loop
and
then
I'm
looking
for
a
response
code
of
ready,
which
will
come
back
from
the
API
function.
A
If
I
don't
get
that
back,
I'll
go
ahead
and
set
the
sleep
timer
for
another
10
seconds
or
whatever
value
you
want
to
pass
in
and
then
eventually
once
I
get
that
or
if
I
get
an
error,
I'll
break
out
of
the
loop
so
that
it
doesn't
go
into
an
infinite
loop
once
they
get
it
back.
I
get
the
response.
I
take
that
response,
and
in
the
case
of
some
sites,
especially
if
they're
hosted
in
Amazon
or
any
of
the
cloud
providers,
you
may
have
multiple
endpoints
that
come
back.
A
I
really
only
care
about
one
one
of
them
because
generally
they're
all
going
to
return
the
same
grade
so
I
just
grabbed
the
first
one
out
of
here
and
then
I
start
grabbing
individual
pieces
that
you
know
our
company
finds
useful
or
that
I
find
interesting.
I
want
to
see
the
list
of
protocols
the
cipher
suites
so
to
get
revocation
status
within
their
API
there's
their
certain
codes.
So
I
map
those
up
with
a
switch
statement
and
based
on
what
I
get
back
to
me
in
the
response.
A
The
API
returns
epoch
time
or
epoch
time,
depending
on
how
you
want
to
pronounce
so
I
convert
those
over
to
the
date
times
that
I
can
read,
join
all
this
together
and
then,
basically,
once
I
had
my
my
final
results
that
I
can
send
that
back
and
in
the
function
response
itself
or
like
I
show
here.
In
an
example.
A
When
it
comes
back
after
I
put
it
into
CSV,
you
can
see
kind
of
a
general
sense
of
what
the
data
would
look
will
look
like
here
are
those
date
times
that
got
converted
into
central
time.
For
me,
the
protocols
that
I
want
to
see,
if
there's
any
sites
that
are
not
running
that
are
not
TLS
one
to
only
because
that's
one
of
the
things
that
we
try
to
to
restrict
here,
I'm
running
them
against
a
couple
of
my
personal
sites.
A
I
happen
to
do
sports
photography
on
the
side,
so
these
are
the
domains
that
I
own,
so
I,
just
test
it
against
them,
and
then
again
the
the
cipher
suites
I
I
combine
those
with
a
joint
statement
so
that
it's
easier
to
dump
them
into
a
single
column.
If
I
need
to
break
these
out
later,
to
do
any
started,
recording
I
can
just
do
a
simple
split
which
is
kind
of
how
I'm
doing
it
today
me
and
there's
two
different
grades
that
come
back
from
SSL
labs,
there's
the
standard
grade
and
then
for
some
sites.
A
If
they're
running
a
mismatched
certificate
or
if
it's
an
expired
certificate,
you
may
want
to
see
what
those
look
like.
So
that's
this
trust
ignored
so
I
grabbed
both
of
those
results
in
County
Korea
against
both
of
them.
As
far
as
the
data
I
won't
make.
You
guys
sit
through
watching
it,
so
I
cued
it
up,
and
this
is
kind
of
what
it
looks
like
if
you
were
to
run
it
I'm
just
gonna
set
a
variable
and
then
I
passed
the
function.
A
This
can
be
a
single
domain
or
I
can
grab
a
list
of
domains
out
of
a
text.
File
set
my
flags
and
then,
when
I
generally
run
these
in
the
background,
I'll
turn
the
verbose
on
so
like
I
said,
I
can
watch
if
it's
one
of
one
one
of
twenty
one
of
two
of
twenty
and
then
it
just
basically
goes
through
and
it
it
iterates
checks.
If
it's
not
ready,
it
would
continue
to
check
until
it
finally
gets
to
the
status
of
ready
and
it'll
move
on
to
the
next
one.