add ssl/tls hardening to nginx

2026-03-20 16:05:41 -04:00
parent 2bcf67dcc4
commit cce9b5c4c4
2 changed files with 43 additions and 0 deletions
@@ -0,0 +1,32 @@
+"""Test that TLS is properly hardened on all HTTPS sites."""
+
+import socket
+import ssl
+
+import pytest
+
+HOST = "www.hantim.net"
+
+
+def test_tls13_works():
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_3
+    ctx.maximum_version = ssl.TLSVersion.TLSv1_3
+    with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
+        assert s.version() == "TLSv1.3"
+
+
+def test_tls12_works():
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_2
+    ctx.maximum_version = ssl.TLSVersion.TLSv1_2
+    with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
+        assert s.version() == "TLSv1.2"
+
+
+def test_tls11_rejected():
+    ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
+    ctx.minimum_version = ssl.TLSVersion.TLSv1_1
+    ctx.maximum_version = ssl.TLSVersion.TLSv1_1
+    with pytest.raises((ssl.SSLError, OSError)):
+        ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)