35 lines
1.1 KiB
Python
35 lines
1.1 KiB
Python
"""Test that TLS is properly hardened on all HTTPS sites."""
|
|
|
|
import socket
|
|
import ssl
|
|
|
|
import pytest
|
|
|
|
HOST = "www.hantim.net"
|
|
|
|
|
|
def test_tls13_works():
|
|
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
|
ctx.load_default_certs()
|
|
ctx.minimum_version = ssl.TLSVersion.TLSv1_3
|
|
ctx.maximum_version = ssl.TLSVersion.TLSv1_3
|
|
with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
|
|
assert s.version() == "TLSv1.3"
|
|
|
|
|
|
def test_tls12_works():
|
|
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
|
ctx.load_default_certs()
|
|
ctx.minimum_version = ssl.TLSVersion.TLSv1_2
|
|
ctx.maximum_version = ssl.TLSVersion.TLSv1_2
|
|
with ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST) as s:
|
|
assert s.version() == "TLSv1.2"
|
|
|
|
|
|
def test_tls11_rejected():
|
|
ctx = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
|
|
ctx.minimum_version = ssl.TLSVersion.TLSv1_1
|
|
ctx.maximum_version = ssl.TLSVersion.TLSv1_1
|
|
with pytest.raises((ssl.SSLError, OSError)):
|
|
ctx.wrap_socket(socket.create_connection((HOST, 443)), server_hostname=HOST)
|