Improved Suite Detection in the Next SSL Labs Release

In one of the future SSL Labs releases we will change how we detect supported protocol suites. Even though there will be no change to the grading algorithm because of this, our detection of obsolete and insecure suites will improve slightly, and that will worsen the grade of a small number of sites. We will publish this new version on October 1st or later.

When it comes to cipher suite detection, SSL Labs does something unusual: it tests for one cipher suite at a time. This is unusual because the obvious thing to do is to submit all suites you support, then see what comes back. The latter approach is faster, but the problem is that it doesn’t always work in practice; many servers break if you submit too many suites or if the ClientHello message is too long. (In one extreme case, a special TLS extension was designed to make sure the record sizes are just right.) In that light, the one-suite-at-a-time approach was the simplest way to get the job done. Sure, this approach is also slow, but SSL Labs does a lot anyway, so our tests are never going to be super-quick.

Slow testing we could live with, but we also noticed that many servers started to take protocol version into account when deciding which cipher suites to support. This change was in response to many issues discovered in the SSL and TLS protocols, contrasted against the need to support older clients. Because SSL Labs tests cipher suites only with the highest-supported protocol version, we started to miss some suites. We added some workarounds for the common cases, but this issue has not been resolved properly.

When you combine our slow cipher suite testing with testing separately for each supported protocol, the testing time rises significantly and we had no choice but to optimise. The good news is that this change improves the cipher suite detection and also works about 30% faster on average (than now).