Agent skill · security · jeremylongshore
analyzing-tls-config
Analyze a target's TLS configuration — negotiated protocol version, cipher suite, certificate chain, expiry, and downgrade vectors. Use when: SOC2 auditor flagged your endpoint for "weak TLS" but you don't know which control failed (TSC CC6.7 transmission integrity vs CC6.6 encryption) or which cipher is the problem. Threshold: any negotiated TLSv1.0 or TLSv1.1, OR a cipher with RC4 / 3DES / null / EXPORT, OR a cert with under 30 days to expiry, OR a chain that fails hostname verification. Trigger with: "audit tls", "check ssl config", "weak tls", "analyze tls".
Why this skill is useful
Adds a Python script for auditing TLS configurations with specific findings that the AI wouldn't reliably generate on its own.
What it needs
Requires openssl, python3 installed locally. About 5k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Analyzing TLS Configuration Overview This skill audits a target's TLS posture against current best practice (NIST SP 800-52r2, Mozilla TLS Configuration Guidelines, PCI DSS v4.0 Req 4.2.1.1). It reports specific findings — not "your TLS is weak" but "your server negotiated TLSv1.0 with RC4-SHA — see remediation". When the skill produces findings Specific failure thresholds, in order of severity: Finding Severity Threshold Affected control --- --- --- --- TLSv1.0 or TLSv1.1 negotiated HIGH Any handshake completes at v1.0/v1.1 NIST 800-52r2 §3.1, PCI DSS Req 4.2.1.1 Null / EXPORT / anonymous cipher CRITICAL Any null / EXPORT / aNULL in negotiated suite NIST 800-52r2 §3.3.1 RC4 / 3DES cipher HIGH Sweet32, RC4 biases NIST 800-52r2 §3.3.1, PCI DSS Req 4.2.1.1 Cert expires in <7 days CRITICAL notAfter - now ≤ 7d NIST 800-52r2 §4.1 Cert expires in <30 days HIGH notAfter - now ≤ 30d NIST 800-52r2 §4.1 Cert hostname mismatch HIGH SAN/CN doesn't match target host RFC 6125 Self-signed or untrusted CA MEDIUM Chain doesn't validate to system CA Mozilla TLS Guidelines Weak key (RSA < 2048, ECDSA < 256) HIGH Public key bits below threshold NIST 800-52r2 §3.4 Forward secrecy absent MEDIUM No ECDHE / DHE in negotiated suite NIST 800-52r2 §3.3.1 Prerequisites Python 3.9+ openssl CLI (used for cipher enumeration the Python ssl module can't introspect directly) Authorization to test the target (active scan — see references/AUTHORIZATION.md) Instructions Step 1 — Confirm Authorization Active scan. Before invoking the scanner, ask the user verbatim: "Do you have authorization to perform TLS testing on this target? I need confirmation before proceeding." If the user says yes, proceed. If unsure, ask them to obtain written authorization. See references/AUTHORIZATION.md for the attestation pattern. Never run the scanner against a target the user does not own or have written permission to test. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/analyzing-tls-config