Secure Sockets Layer Health Assessment

Abstract Tilburg University needs a tool which can assess their SSL services automatically. The research conducted in this paper is performed to determine a health value for an SSL service, which can be implemented in an SSL assessment tool. To determine this value various research has been done. First, it has been determined what a "good" SSL implementation should look like. A good implementation has for example a valid certificate and has implemented the full chain of trust, but also prohibits the use of SSLv2. After determining what a good SSL service requires, the findings have been compared to common services. Amongst common services are online banking environments, social networks, etc. As it turns out, lots of common services do not implement SSL as it should be. The findings of this research have been used to develop a series of SSL "tests". Each of these tests is given a weight based upon the research or it is called required. A required test should never fail. If a weighed test fails, the eventual SSL "health" will simply become less. Combining these tests with a proof of concept implementation, based upon existing software, makes it possible to assess an SSL service in a way that covers the demands of Tilburg University. This is giving a single grade to a service which relates to the health status of the service