PFS key size in PFS summary about testssl.sh HOT 5 CLOSED

It's certainly a nice to have. There are other things more important for now. (BTW: It has nothing to do with the openssl version and if you follow the instruction @ https://github.com/drwetter/testssl.sh/tree/master/openssl-bins/openssl-1.0.2-chacha.pm/ you will have openssl 1.0.2++ ;-)

from testssl.sh.

Well, it's just much easier to extract with 1.0.2 as it's in a field ready to be parsed without having to analyse a hex output :).

And I find the info very useful as there is no point having a 4096bit cert if Apache is exchanging keys with DH1024, but there is no rush.

from testssl.sh.

The point is that one can't force users to use a specific OpenSSL version. Compatibility is more important to me. The biggest pain is Mac OsX. Latest version still has 0.98z (?).

From the crypto perspective personally I 'd rather prefer DH w/ 1024 bits as encryption with EC algorithm. But that's more a gut instinct. Still I agree, an indicator would be a nice to have.

from testssl.sh.

Oh, I missed tto comment on that.

@oparoz maybe you were ahead on time ;-) That was implemented in060178071dbb30d0b9235989387af29ff04f4e43 because of Logjam, see #105, #106, #107 .

from testssl.sh.

👍

from testssl.sh.