
=       Command | Description
=---------------+------------------------------------------------------------
                  Commands for information about this tool
+dump             Dumps internal data for SSL connection and target certificate.
+exec             Internal command; should not be used directly.
+help             Complete documentation.
+list             Show all ciphers supported by this tool.
+libversion       Show version of openssl.
+quit             Show internal data and exit, used for debugging only.
+VERSION          Just show version and exit.
+version          Show version information for program and Perl modules.

                  Commands to check SSL details
+bsi              Various checks according BSI TR-02102-2 and TR-03116-4 compliance.
+check            Check the SSL connection for security issues.
+check_sni        Check for Server Name Indication (SNI) usage.
+ev               Various checks according certificate's extended Validation (EV).
+http             Perform HTTP checks.
+info             Overview of most important details of the SSL connection.
+info--v          More detailled overview.
+quick            Quick overview of checks.
+protocols        Check for protocols supported by target.
+s_client         Dump data retrieved from  "openssl s_client ..."  call.
+sizes            Check length, size and count of some values in the certificate.
+sni              Check for Server Name Indication (SNI) usage.
+sts              Various checks according STS HTTP header.
+vulns            Check for various vulnerabilities.

                  Commands to test ciphers provided by target
+cipher           Check target for ciphers (using libssl).
+cipher-dh        Check target for ciphers (using libssl), prints also DH parameter.
+cipher-default   Check target for (default) selected cipher for each protocol.
+cipher-null      Check if target accepts NULL ciphers.
+cipher-adh       Check if target accepts ciphers with anonymous key exchange.
+cipher-exp       Check if target accepts EXPORT ciphers.
+cipher-cbc       Check if target accepts CBC ciphers.
+cipher-des       Check if target accepts DES ciphers.
+cipher-rc4       Check if target accepts RC4 ciphers.
+cipher-edh       Check if target supports ephemeral ciphers.
+cipher-pfs       Check if target supports ciphers with PFS.
+cipher-strong    Check if target selects strongest cipher.
+cipher-selected  Selected cipher.


                  Commands to show results of checked connection and certificate details
+cn_nosni         Certificate CN without SNI
+pem              Certificate PEM
+text             Certificate PEM decoded
+cn               Certificate Common Name
+subject          Certificate Subject
+issuer           Certificate Issuer
+altname          Certificate Subject's Alternate Names
+cipher_selected  Selected Cipher
+ciphers_local    Local SSLlib Ciphers
+ciphers          Client Ciphers
+dates            Certificate Validity (date)
+before           Certificate valid since
+after            Certificate valid until
+aux              Certificate Trust Information
+email            Certificate Email Addresses
+pubkey           Certificate Public Key
+pubkey_algorithm Certificate Public Key Algorithm
+pubkey_value     Certificate Public Key Value
+modulus_len      Certificate Public Key Length
+modulus          Certificate Public Key Modulus
+modulus_exponent Certificate Public Key Exponent
+serial           Certificate Serial Number
+serial_hex       Certificate Serial Number (hex)
+serial_int       Certificate Serial Number (int)
+certversion      Certificate Version
+sigdump          Certificate Signature (hexdump)
+sigkey_len       Certificate Signature Key Length
+signame          Certificate Signature Algorithm
+sigkey_value     Certificate Signature Key Value
+trustout         Certificate trusted
+extensions       Certificate extensions
+tlsextdebug      TLS extensions (debug)
+tlsextensions    TLS extensions
+ext_authority    Certificate extensions Authority Information Access
+ext_authorityid  Certificate extensions Authority key Identifier
+ext_constraints  Certificate extensions Basic Constraints
+ext_cps          Certificate extensions Certificate Policies
+ext_cps_cps      Certificate extensions Certificate Policies: CPS
+ext_cps_policy   Certificate extensions Certificate Policies: Policy
+ext_cps_notice   Certificate extensions Certificate Policies: User Notice
+ext_crl          Certificate extensions CRL Distribution Points
+ext_subjectkeyid Certificate extensions Subject Key Identifier
+ext_keyusage     Certificate extensions Key Usage
+ext_extkeyusage  Certificate extensions Extended Key Usage
+ext_certtype     Certificate extensions Netscape Cert Type
+ext_issuer       Certificate extensions Issuer Alternative Name
+ocsp_uri         Certificate OCSP Responder URL
+ocspid           Certificate OCSP Hashes
+ocsp_subject_hash Certificate OCSP Subject Hash
+ocsp_public_hash Certificate OCSP Public Key Hash
+ocsp_response    Target's OCSP Response
+ocsp_response_data Target's OCSP Response Data
+ocsp_response_status Target's OCSP Response Status
+ocsp_cert_status Target's OCSP Response Cert Status
+ocsp_next_update Target's OCSP Response Next Update
+ocsp_this_update Target's OCSP Response This Update
+subject_hash     Certificate Subject Name Hash
+issuer_hash      Certificate Issuer Name Hash
+selfsigned       Certificate Validity (signature)
+fingerprint_type Certificate Fingerprint Algorithm
+fingerprint_hash Certificate Fingerprint Hash Value
+fingerprint_sha2 Certificate Fingerprint SHA2
+fingerprint_sha1 Certificate Fingerprint SHA1
+fingerprint_md5  Certificate Fingerprint  MD5
+fingerprint      Certificate Fingerprint
+cert_type        Certificate Type (bitmask)
+sslversion       Selected SSL Protocol
+resumption       Target supports Resumption
+renegotiation    Target supports Renegotiation
+compression      Target supports Compression
+expansion        Target supports Expansion
+krb5             Target supports Krb5
+psk_hint         Target supports PSK Identity Hint
+psk_identity     Target supports PSK
+srp              Target supports SRP
+heartbeat        Target supports Heartbeat
+master_secret    Target supports Extended Master Secret
+next_protocols   Target's advertised protocols
+alpn             Target's selected protocol (ALPN)
+npn              Target's selected protocol  (NPN)
+alpns            Target's supported ALPNs
+npns             Target's supported  NPNs
+master_key       Target's Master-Key
+public_key_len   Target's Server public key length
+session_id       Target's Session-ID
+session_id_ctx   Target's Session-ID-ctx
+session_protocol Target's selected SSL Protocol
+session_ticket   Target's TLS Session Ticket
+session_lifetime Target's TLS Session Ticket Lifetime
+session_timeout  Target's TLS Session Timeout
+session_starttime Target's TLS Session Start Time EPOCH
+session_startdate Target's TLS Session Start Time locale
+dh_parameter     Target's DH Parameter
+chain            Certificate Chain
+chain_verify     CA Chain Verification (trace)
+verify           Validity Certificate Chain
+error_verify     CA Chain Verification error
+error_depth      CA Chain Verification error in level
+verify_altname   Validity Alternate Names
+verify_hostname  Validity Hostname
+https_protocols  HTTPS Alternate-Protocol
+https_svc        HTTPS Alt-Svc header
+https_status     HTTPS Status line
+https_server     HTTPS Server banner
+https_location   HTTPS Location header
+https_refresh    HTTPS Refresh header
+https_alerts     HTTPS Error alerts
+https_pins       HTTPS Public-Key-Pins header
+https_body       HTTPS Body
+https_sts        HTTPS STS header
+hsts_httpequiv   HTTPS STS in http-equiv
+hsts_maxage      HTTPS STS MaxAge
+hsts_subdom      HTTPS STS include sub-domains
+hsts_preload     HTTPS STS preload
+http_protocols   HTTP Alternate-Protocol
+http_svc         HTTP Alt-Svc header
+http_status      HTTP Status line
+http_location    HTTP Location header
+http_refresh     HTTP Refresh header
+http_sts         HTTP STS header
+options          internal used SSL options bitmask
+fallback_protocol Target's fallback SSL Protocol
+valid_years      certificate validity in years
+valid_months     certificate validity in months
+valid_days       certificate validity in days
+valid_host       dummy used for printing DNS stuff

                  Commands to show results of checked certificate data
+verify           Certificate chain validated
+fp_not_md5       Certificate Fingerprint is not MD5
+dates            Certificate is valid
+expired          Certificate is not expired
+certfqdn         Certificate is valid according given hostname
+wildhost         Certificate's wildcard does not match hostname
+wildcard         Certificate does not contain wildcards
+rootcert         Certificate is not root CA
+selfsigned       Certificate is not self-signed
+dv               Certificate Domain Validation (DV)
+ev+              Certificate strict Extended Validation (EV)
+ev-              Certificate lazy Extended Validation (EV)
+ocsp_uri         Certificate has OCSP Responder URL
+cps              Certificate has Certification Practice Statement
+crl              Certificate has CRL Distribution Points
+zlib             Certificate has (TLS extension) compression
+lzo              Certificate has (GnuTLS extension) compression
+open_pgp         Certificate has (TLS extension) authentication
+ocsp_valid       Certificate has valid OCSP URL
+cps_valid        Certificate has valid CPS URL
+crl_valid        Certificate has valid CRL URL
+sernumber        Certificate Serial Number size RFC 5280
+constraints      Certificate Basic Constraints is false
+sha2signature    Certificate Private Key Signature SHA2
+modulus_exp_1    Certificate Public Key Modulus Exponent <>1
+modulus_size_oldssl Certificate Public Key Modulus >16385 bits
+modulus_exp_65537 Certificate Public Key Modulus Exponent =65537
+modulus_exp_oldssl Certificate Public Key Modulus Exponent >65537
+pub_encryption   Certificate Public Key with Encryption
+pub_enc_known    Certificate Public Key Encryption known
+sig_encryption   Certificate Private Key with Encryption
+sig_enc_known    Certificate Private Key Encryption known
+rfc_6125_names   Certificate Names compliant to RFC 6125
+rfc_2818_names   Certificate subjectAltNames compliant to RFC 2818
+nonprint         Certificate does not contain non-printable characters
+crnlnull         Certificate does not contain CR, NL, NULL characters
+ev_chars         Certificate has no invalid characters in extensions

                  Commands to show results of checked connection data
+reversehost      Given hostname is same as reverse resolved hostname
+hostname         Connected hostname equals certificate's Subject
+beast            Connection is safe against BEAST attack (any cipher)
+breach           Connection is safe against BREACH attack
+ccs              Connection is safe against CCS Injection attack
+crime            Connection is safe against CRIME attack
+drown            Connection is safe against DROWN attack
+time             Connection is safe against TIME attack
+freak            Connection is safe against FREAK attack
+heartbleed       Connection is safe against Heartbleed attack
+logjam           Connection is safe against Logjam attack
+lucky13          Connection is safe against Lucky 13 attack
+poodle           Connection is safe against POODLE attack
+rc4              Connection is safe against RC4 attack
+robot            Connection is safe against ROBOT attack
+sloth            Connection is safe against SLOTH attack
+sweet32          Connection is safe against Sweet32 attack
+sni              Connection is not based on SNI

                  Commands to show results of checked target (connection) data
+sgc              Target supports Server Gated Cryptography (SGC)
+hassslv2         Target does not support SSLv2
+hassslv3         Target does not support SSLv3
+hastls10         Target does not supports TLSv1
+hastls11         Target does not supports TLSv1.1
+hastls10_old     Target supports TLSv1
+hastls11_old     Target supports TLSv1.1
+hastls12         Target supports TLSv1.2
+hastls13         Target supports TLSv1.3
+hasdtls1         Target supports DTLSv1
+hasdtls12        Target supports DTLSv1.2
+hasdtls13        Target supports DTLSv1.3
+hasalpn          Target supports ALPN
+hasnpn           Target supports  NPN
+cipher_strong    Target selects strongest cipher
+cipher_order     Target does not honors client's cipher order
+cipher_weak      Target does not accept weak cipher
+cipher_null      Target does not accept NULL ciphers
+cipher_adh       Target does not accept ADH ciphers
+cipher_exp       Target does not accept EXPORT ciphers
+cipher_cbc       Target does not accept CBC ciphers
+cipher_des       Target does not accept DES ciphers
+cipher_rc4       Target does not accept RC4 ciphers
+cipher_edh       Target supports EDH ciphers
+cipher_pfs       Target supports PFS (selected cipher)
+cipher_pfsall    Target supports PFS (all ciphers)
+closure          Target understands TLS closure alerts
+compression      Target does not support Compression
+fallback         Target supports fallback from TLSv1.1
+ism              Target is ISM compliant (ciphers only)
+pci              Target is PCI compliant (ciphers only)
+fips             Target is FIPS-140 compliant
+tr_02102+        Target is strict TR-02102-2 compliant
+tr_02102-        Target is  lazy  TR-02102-2 compliant
+tr_03116+        Target is strict TR-03116-4 compliant
+tr_03116-        Target is  lazy  TR-03116-4 compliant
+rfc_7525         Target is RFC 7525 compliant
+sstp             Target does not support method SSTP
+resumption       Target supports Resumption
+renegotiation    Target supports Secure Renegotiation
+krb5             Target supports Krb5
+psk_hint         Target supports PSK Identity Hint
+psk_identity     Target supports PSK
+srp              Target supports SRP
+ocsp_stapling    Target supports OCSP Stapling
+master_secret    Target supports Extended Master Secret
+session_ticket   Target supports TLS Session Ticket
+session_lifetime Target TLS Session Ticket Lifetime
+session_starttime Target TLS Session Start Time match
+session_random   Target TLS Session Ticket is random
+heartbeat        Target does not support heartbeat extension
+scsv             Target does not support SCSV
+dh_512           Target DH Parameter >= 512 bits
+dh_2048          Target DH Parameter >= 2048 bits
+ecdh_256         Target DH Parameter >= 256 bits (ECDH)
+ecdh_512         Target DH Parameter >= 512 bits (ECDH)

                  Commands to show results of checked length and count data
+len_pembase64    Certificate PEM (base64) size
+len_pembinary    Certificate PEM (binary) size
+len_subject      Certificate Subject size
+len_issuer       Certificate Issuer size
+len_cps          Certificate CPS size
+len_crl          Certificate CRL size
+len_crl_data     Certificate CRL data size
+len_ocsp         Certificate OCSP size
+len_oids         Certificate OIDs size
+len_publickey    Certificate Public Key size
+len_sigdump      Certificate Signature Key size
+len_altname      Certificate Subject Altname size
+len_chain        Certificate Chain size
+len_sernumber    Certificate Serial Number size
+cnt_altname      Certificate Subject Altname count
+cnt_wildcard     Certificate Wildcards count
+cnt_chaindepth   Certificate Chain Depth count
+cnt_ciphers      Total number of checked ciphers
+cnt_totals       Total number of accepted ciphers
+cnt_checks_noo   Total number of check results 'no(<<)'
+cnt_checks_no    Total number of check results 'no'
+cnt_checks_yes   Total number of check results 'yes'
+cnt_exitcode     Total number of insecure checks

                  Commands to show results of checked HTTP vs. HTTPS data
+sts_maxage0d     STS max-age not reset
+sts_maxage1d     STS max-age less than one day
+sts_maxage1m     STS max-age less than one month
+sts_maxage1y     STS max-age less than one year
+sts_maxagexy     STS max-age more than one year
+sts_maxage18     STS max-age more than 18 weeks
+sts_expired      STS max-age < certificate's validity
+hsts_sts         Target sends STS header
+sts_maxage       Target sends STS header with proper max-age
+sts_subdom       Target sends STS header with includeSubdomain
+sts_preload      Target sends STS header with preload
+hsts_is301       Target redirects with status code 301
+hsts_is30x       Target redirects not with 30x status code
+hsts_fqdn        Target redirect matches given host
+http_https       Target redirects HTTP to HTTPS
+hsts_location    Target sends STS and no Location header
+hsts_refresh     Target sends STS and no Refresh header
+hsts_redirect    Target redirects HTTP without STS header
+hsts_samehost    Target redirects HTTP to HTTPS same host
+hsts_ip          Target does not send STS header for IP
+hsts_httpequiv   Target does not send STS in meta tag
+https_pins       Target sends Public-Key-Pins header

                  Commands locally defined in ./.o-saft.pl
+preload          Check STS header preload attributes
+ciphercheck      Check various cipher usage
+names            Collection of all info and check commands related to certificate names
+ocsp             Collection of all info and check commands related to OCSP data
+fingerprints     Check all certificate fingerprints
=---------------+------------------------------------------------------------

