#!/bin/sh -

# whichssl - probe which SSL protocols are enabled on the given server
# Steve Kinzler, steve@kinzler.com, Jan 2019/Mar 2020
# https://kinzler.com/me/home.html#webadm

# requires nmap package, eg on SUSE:	# zypper install nmap

openssl=
case "$1" in
-h)	echo "usage: $0 [ -o ] host[:port] ..." 1>&2; exit 1;;
-o)	openssl=t; shift;;
esac

for host
do
	case "$host" in
	*:*)	port=`echo "$host" | sed 's/.*://'`
		host=`echo "$host" | sed 's/:.*//'`;;
	*)	port=443;;
	esac

	case "$openssl" in
	?*)	/bin/echo -n "$host:$port offers"
		for prot in ssl3 tls1 tls1_1 tls1_2 tls1_3
		do
			openssl s_client -$prot "$host:$port" < /dev/null \
				> /dev/null 2>&1 && /bin/echo -n " $prot"
		done
		echo;;

	*)	nmap -sV --script ssl-enum-ciphers -p "$port" "$host";;
	esac
done