A Python-based TLS/SSL scanner for auditing third-party vendor connections against organizational encryption compliance policy.
Built as a practical lab project aligned to real-world Application Security workflows in financial services environments.
- Probes live third-party endpoints via TLS handshake
- Evaluates each connection against a defined encryption policy
- Detects 10 categories of encryption failures
- Flags internal network endpoints for manual review escalation
- Generates a formatted Excel report with 4 sheets: Dashboard, Full Results, Findings Detail, and Manual Review Tracker
| Failure | Severity |
|---|---|
| Expired Certificate | CRITICAL |
| Revoked Certificate | CRITICAL |
| Hostname Mismatch | HIGH |
| Self-Signed Certificate | HIGH |
| Untrusted Root CA | HIGH |
| Incomplete Certificate Chain | HIGH |
| Weak Cipher (RC4) | HIGH |
| TLSv1.0 Protocol | HIGH |
| TLSv1.1 Protocol | MEDIUM |
| SHA-1 Intermediate Chain | MEDIUM |
| Control | Requirement |
|---|---|
| Minimum TLS Version | TLSv1.2 (TLSv1.3 preferred) |
| Banned Protocols | SSLv2, SSLv3, TLSv1.0, TLSv1.1 |
| Cipher Requirement | AEAD ciphers with Perfect Forward Secrecy |
| Certificate Authority | Recognized public CA only |
| Certificate Validity | 90-day expiry warning threshold |
27 connections scanned across three regions:
- AMER — Visa, SWIFT, Plaid, Moody's, Salesforce, TD Bank, internal servers
- EMEA — Bloomberg, LexisNexis, legacy banking systems (Finacle, Temenos, Murex)
- APAC — Mastercard, AWS, legacy systems (FIS Global, Oracle FLEXCUBE, Finacle)
Internal private IP endpoints (10.x, 172.16.x, 192.168.x) are automatically flagged for on-site verification by Network Security.
Each scan run produces:
Encryption_Recertification_<timestamp>.xlsx— 4-sheet formatted Excel reportscan_<timestamp>.json— machine-readable output for SIEM/ticketing integration
pip install openpyxl
python tls_scanner.py- TLS/SSL protocol knowledge (version hierarchy, cipher suites, PFS, certificate chain validation)
- Python automation for security compliance workflows
- Encryption policy enforcement and evidence generation
- AMER/EMEA/APAC regional audit coordination workflow
- Excel report generation for stakeholder communication