6.5 KiB

Raw Blame History

TLS Testing Guide for Ᾰenebris

This document describes how to test all TLS/SSL features in Ᾰenebris.

Prerequisites

Generate test certificates:

./examples/generate-test-certs.sh

Start test backend servers:

# Terminal 1: Main backend on port 8000
python examples/test_backend_multi.py 8000

# Terminal 2 (for SNI testing): API backend on port 8001
python examples/test_backend_multi.py 8001

# Terminal 3 (for SNI testing): Web backend on port 8002
python examples/test_backend_multi.py 8002

Test 1: Single Certificate HTTPS

Config: examples/config-https.yaml

Start proxy:

./aenebris examples/config-https.yaml

Tests:

Test HTTP → HTTPS Redirect

# Should return 301 redirect to HTTPS
curl -v http://localhost:8080/

# Expected: Location: https://localhost:8080/

Test HTTPS Connection

# Make HTTPS request (-k ignores self-signed cert)
curl -k https://localhost:8443/

# Expected: Response from backend server

Test TLS 1.3

# Verify TLS 1.3 is available
openssl s_client -connect localhost:8443 -tls1_3

# Expected: Should succeed with "Protocol  : TLSv1.3"

Test TLS 1.2

# Verify TLS 1.2 is also supported
openssl s_client -connect localhost:8443 -tls1_2

# Expected: Should succeed with "Protocol  : TLSv1.2"

Test TLS 1.1 Rejected

# Verify old TLS is rejected
openssl s_client -connect localhost:8443 -tls1_1 2>&1 | grep -i "error\|alert"

# Expected: Should fail with "no protocols available" or similar

Test Security Headers

# Check security headers are present
curl -k -I https://localhost:8443/

# Expected headers:
# - Strict-Transport-Security: max-age=2592000; includeSubDomains
# - Content-Security-Policy: default-src 'self'; ...
# - X-Frame-Options: DENY
# - X-Content-Type-Options: nosniff
# - Referrer-Policy: strict-origin-when-cross-origin
# - Permissions-Policy: geolocation=(), ...
# - Expect-CT: max-age=86400, enforce
# - Server: Aenebris

Test HTTP/2

# Verify HTTP/2 is negotiated via ALPN
curl -k --http2 -v https://localhost:8443/ 2>&1 | grep "ALPN"

# Expected: "ALPN, server accepted to use h2"

Test Cipher Suites

# List negotiated cipher suite
openssl s_client -connect localhost:8443 -tls1_3 2>&1 | grep "Cipher"

# Expected: Strong cipher like:
# - TLS_AES_128_GCM_SHA256
# - TLS_AES_256_GCM_SHA384
# - TLS_CHACHA20_POLY1305_SHA256

Test 2: SNI (Server Name Indication)

Config: examples/config-sni.yaml

Start proxy:

./aenebris examples/config-sni.yaml

Tests:

Test SNI for api.localhost

# Request with Host: api.localhost
curl -k -H "Host: api.localhost" https://localhost:8443/

# Verify correct certificate
openssl s_client -connect localhost:8443 -servername api.localhost 2>&1 | grep "subject"

# Expected: subject=CN = api.localhost

Test SNI for web.localhost

# Request with Host: web.localhost
curl -k -H "Host: web.localhost" https://localhost:8443/

# Verify correct certificate
openssl s_client -connect localhost:8443 -servername web.localhost 2>&1 | grep "subject"

# Expected: subject=CN = web.localhost

Test Default Certificate

# Request with unknown hostname
curl -k -H "Host: unknown.localhost" https://localhost:8443/

# Verify default certificate is used
openssl s_client -connect localhost:8443 -servername unknown.localhost 2>&1 | grep "subject"

# Expected: subject=CN = default.localhost

Test SNI Routing

# Verify api.localhost routes to port 8001 backend
curl -k -H "Host: api.localhost" https://localhost:8443/

# Verify web.localhost routes to port 8002 backend
curl -k -H "Host: web.localhost" https://localhost:8443/

# Check backend logs to confirm correct routing

Test 3: Security Validation

Test Strong Ciphers Only

# Try to connect with weak cipher (should fail)
openssl s_client -connect localhost:8443 -cipher DES-CBC3-SHA 2>&1 | grep -i "error\|alert"

# Expected: Connection should fail, 3DES not allowed

Test HSTS Enforcement

# Check HSTS header prevents downgrade
curl -k -I https://localhost:8443/ | grep -i "strict-transport"

# Expected: Strict-Transport-Security: max-age=2592000; includeSubDomains

Test X-Powered-By Removal

# Verify X-Powered-By is stripped
curl -k -I https://localhost:8443/ | grep -i "powered-by"

# Expected: No X-Powered-By header present

Test Server Header Customization

# Check Server header
curl -k -I https://localhost:8443/ | grep -i "server:"

# Expected: Server: Aenebris (not revealing version)

Test 4: Performance

Test Connection Reuse

# Make multiple requests with keep-alive
for i in {1..10}; do
  curl -k -s -o /dev/null -w "Time: %{time_total}s\n" https://localhost:8443/
done

# Expected: First request slower (handshake), subsequent faster (reuse)

Test Concurrent Connections

# Benchmark with multiple concurrent connections
# Using 'hey' tool (install: go install github.com/rakyll/hey@latest)
hey -n 1000 -c 10 -disable-keepalive https://localhost:8443/

# Or using Apache Bench:
ab -n 1000 -c 10 -k https://localhost:8443/

# Expected: Should handle concurrent requests without errors

Test 5: Error Handling

Test Invalid Certificate Path

Edit config with invalid cert path, should see clear error:

tls:
  cert: /nonexistent/cert.pem
  key: /nonexistent/key.pem

Expected:

ERROR: Failed to load TLS certificate
  CertFileNotFound "/nonexistent/cert.pem"

Test Mismatched Cert/Key

Use wrong key for certificate, should fail gracefully with clear error.

Test Missing SNI Default

Remove default_cert from SNI config, should fail validation:

SNI configuration error: sni, default_cert, and default_key required

Success Criteria

✅ All tests pass ✅ TLS 1.2 and TLS 1.3 work ✅ TLS 1.0/1.1 rejected ✅ HTTP → HTTPS redirect works ✅ SNI correctly routes to different backends ✅ Strong ciphers only ✅ All security headers present ✅ HTTP/2 negotiated via ALPN ✅ No X-Powered-By leakage ✅ Clear error messages for misconfigurations

SSL Labs Testing (Optional)

For production deployments, test with SSL Labs:

Deploy to public server with real domain
Visit https://www.ssllabs.com/ssltest/
Enter your domain
Target: A+ rating

Key requirements for A+:

TLS 1.2 minimum
Strong cipher suites
HSTS with long max-age
No vulnerabilities (BEAST, POODLE, Heartbleed, etc.)
Perfect Forward Secrecy
HTTP Strict Transport Security

6.5 KiB Raw Blame History