https://cybertoolchain.io/tools/testssl-sh New releases and features in testssl.sh, tracked by The Cyber Toolchain. en Thu, 12 Feb 2026 12:40:53 GMT https://github.com/drwetter/testssl.sh/releases/tag/v3.2.3 https://github.com/drwetter/testssl.sh/releases/tag/v3.2.3 Thu, 12 Feb 2026 12:40:53 GMT testssl.sh v3.2.3 renames the ROBOT timeout environment variable and updates CA stores • Updates the Linux CA store bundle and adds support for the Sectigo R46 root certificate. Breaking changes: • The `MAX_WAITSOCK` environment variable is renamed to `ROBOT_TIMEOUT`; scripts relying on the old name will no longer apply this timeout. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/testssl-sh https://github.com/drwetter/testssl.sh/releases/tag/v3.2.1 https://github.com/drwetter/testssl.sh/releases/tag/v3.2.1 Fri, 13 Jun 2025 08:37:00 GMT testssl.sh v3.2.1 adds Android 15 handshake simulation capability to the CLI • Add `--android15` flag to simulate TLS handshakes for Android 15 devices Full history on Cyber Toolchain: https://cybertoolchain.io/tools/testssl-sh https://github.com/testssl/testssl.sh/releases/tag/v3.2rc4 https://github.com/testssl/testssl.sh/releases/tag/v3.2rc4 Fri, 24 Jan 2025 15:06:34 GMT testssl.sh v3.2rc4 adds ML-KEM/Kyber post-quantum cipher suites, LibreSSL 4 support, and RFC 9150 TLS 1.3 ciphers • `SecP256r1MLKEM768`, `X25519MLKEM768`, `SecP384r1MLKEM1024`, and `X25519Kyber768Draft00` cipher suites are now tested • `RFC 9150` cipher suites (TLS 1.3) are now supported • Support for LibreSSL up to version 4 is added • Stapled OCSP responses using SHA-256 are now supported Full history on Cyber Toolchain: https://cybertoolchain.io/tools/testssl-sh https://github.com/drwetter/testssl.sh/releases/tag/v3.2rc3 https://github.com/drwetter/testssl.sh/releases/tag/v3.2rc3 Tue, 10 Oct 2023 10:33:35 GMT testssl.sh v3.2rc3 adds STARTTLS XMPP support, new flags --user-agent/--reqheader/ --add-ca dir, and SSL Labs-style rating. • Adds SSL certificate ratings similar to SSL Labs • Extends Server (cipher) preference handling: always runs in wide mode instead of all ciphers at the end (per default) • Adds support for certificates with EdDSA signatures and public keys • Extracts CA list showing supported certification authorities sent by the server • Adds TLS 1.2 and TLS 1.3 signature algorithms check • Adds ffdhe groups testing • Allows --add-ca to accept a directory with *.pem files • Adds environment variable for amount of attempts for ssl renegotiation check • Adds `--user-agent` argument to support using a custom User Agent • Adds `--overwrite` argument to support overwriting output files without warning • Enables strict parser for HSTS • Adds `--reqheader` to support custom headers in HTTP requests • Tests for support for RFC 8879 certificate compression • Adds test for STARTTLS injection vulnerabilities (SMTP, POP3, IMAP) • Adds XMPP server support for STARTTLS • Adds STARTTLS on active directory service support • Tests for old winshock vulnerability Breaking changes: • Removes the display of 'negotiated cipher / protocol' from output Full history on Cyber Toolchain: https://cybertoolchain.io/tools/testssl-sh https://github.com/testssl/testssl.sh/releases/tag/v3.0.8 https://github.com/testssl/testssl.sh/releases/tag/v3.0.8 Wed, 28 Sep 2022 19:17:47 GMT testssl.sh v3.0.8 adds client simulation suite updates and RSA-PSS/FFDHE support • `Major update of client simulation` with 9 new simulations and >4 removed in default run. • `Include RSA-PSS in ClientHello` to enable checking for that cipher suite capability. • `Add FFDHE groups to supported_groups` during client hello construction. Breaking changes: • >4 simulations removed from the default run. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/testssl-sh