TlsTestGate is an Azure DevOps extension that tests endpoints for non-compliant SSL/TLS settings and enforces compliance gates in build or release pipelines.
Test public or internal endpoints for non-compliant SSL/TLS settings using Azure DevOps. The extension can be inserted into a build or release pipeline and can serve as a compliance gate.
This tool is used by DevOps and security teams to automatically audit SSL/TLS configurations of public or internal endpoints during CI/CD processes. It helps ensure that endpoints comply with organizational or industry security standards by identifying weak or deprecated cipher suites and failing builds or releases when non-compliance is detected.
TlsTestGate relies on the SSLyze API for scanning and currently considers SSL 2.0/3.0 and TLS 1.0/1.1 cipher suites as non-compliant, along with certain weak TLS 1.2 ciphers; users should keep the list of valid ciphers updated as security standards evolve. The tool supports split-view DNS scenarios by allowing specification of DNS servers, which is important for accurate internal vs external endpoint testing. Fixing issues may require changes not only on web servers but also on load balancers or reverse proxies depending on network topology.
Create and activate a Python virtual environment: python3 -m venv foo && cd foo && source bin/activate
Clone the repository: git clone https://github.com/metlife/tlstestgate.git
Navigate into the cloned directory: cd tlstestgate
Install Python dependencies: pip install -r requirements.txt
Download and install Node.js from https://nodejs.org/en/download/
Install TypeScript compiler globally: npm install -g typescript
Install TFS Cross Platform Command Line Interface (tfx-cli) as per Microsoft documentationsteps: - task: JoeGatt.TlsTestGate.custom-build-release-task.TlsTestGate@1 displayName: 'github.com SSL/TLS Test Gate' inputs: baseURL: github.com port: 443 dnsserver: 8.8.8.8 failBuild: true
YAML snippet to add TlsTestGate as a task in an Azure DevOps pipeline that scans github.com on port 443 using Google DNS and fails the build if non-compliant SSL/TLS settings are found.