Method _analyze_ssl_security

validators/http_validator.py:200–251

Analyze SSL certificate and connection security

(self, ssl_info, cert)

        return ssl_info
    
    def _analyze_ssl_security(self, ssl_info, cert):
        """Analyze SSL certificate and connection security"""
        analysis = {
            'security_level': 'Unknown',
            'warnings': [],
            'recommendations': []
        }
        
        try:
            # Check cipher strength
            cipher_bits = ssl_info.get('cipher_bits', 0)
            if cipher_bits < 128:
                analysis['warnings'].append(f"Weak cipher strength: {cipher_bits} bits")
                analysis['security_level'] = 'Weak'
            elif cipher_bits < 256:
                analysis['security_level'] = 'Moderate'
            else:
                analysis['security_level'] = 'Strong'
            
            # Check protocol version
            protocol = ssl_info.get('protocol_version', '')
            if protocol in ['SSLv2', 'SSLv3', 'TLSv1', 'TLSv1.1']:
                analysis['warnings'].append(f"Outdated protocol: {protocol}")
                analysis['recommendations'].append("Upgrade to TLS 1.2 or higher")
            
            # Check certificate validity period
            validity_days = ssl_info.get('validity_period_days', 0)
            if validity_days > 825:  # More than ~2.3 years
                analysis['warnings'].append(f"Long validity period: {validity_days} days")
                analysis['recommendations'].append("Consider shorter certificate validity periods")
            
            # Check expiration
            days_until_expiry = ssl_info.get('days_until_expiry', 0)
            if days_until_expiry < 30:
                analysis['warnings'].append(f"Certificate expires soon: {days_until_expiry} days")
                analysis['recommendations'].append("Renew certificate soon")
            
            # Check for self-signed
            if ssl_info.get('is_self_signed', False):
                analysis['warnings'].append("Self-signed certificate")
                analysis['recommendations'].append("Use CA-issued certificate for production")
            
            # Check common name vs SAN
            subject_cn = ssl_info.get('subject', {}).get('commonName', '')
            san_dns = ssl_info.get('san_dns_names', [])
            if subject_cn and subject_cn not in san_dns:
                analysis['warnings'].append("Common Name not in Subject Alternative Names")
            
        except Exception as e:
            analysis['error'] = str(e)[:MAX_ERROR_LENGTH]
            
        return analysis
    
    def _extract_public_key_info(self, cert):
        """Extract public key information from certificate"""