{"action":"created","issue":{"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/362","repository_url":"https://api.github.com/repos/ssllabs/ssllabs-scan","labels_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/362/labels{/name}","comments_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/362/comments","events_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/362/events","html_url":"https://github.com/ssllabs/ssllabs-scan/issues/362","id":163294531,"number":362,"title":"Suggestion on performance of SSLLabs scanning","user":{"login":"ghost","id":10137,"avatar_url":"https://avatars.githubusercontent.com/u/10137?v=3","gravatar_id":"","url":"https://api.github.com/users/ghost","html_url":"https://github.com/ghost","followers_url":"https://api.github.com/users/ghost/followers","following_url":"https://api.github.com/users/ghost/following{/other_user}","gists_url":"https://api.github.com/users/ghost/gists{/gist_id}","starred_url":"https://api.github.com/users/ghost/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ghost/subscriptions","organizations_url":"https://api.github.com/users/ghost/orgs","repos_url":"https://api.github.com/users/ghost/repos","events_url":"https://api.github.com/users/ghost/events{/privacy}","received_events_url":"https://api.github.com/users/ghost/received_events","type":"User","site_admin":false},"labels":[{"id":137690452,"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/labels/enhancement","name":"enhancement","color":"84b6eb","default":true}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":4,"created_at":"2016-07-01T00:15:37Z","updated_at":"2016-11-29T11:06:53Z","closed_at":"2016-11-29T11:06:53Z","body":"**Suggestion/Question 1**:\nHi! I used Wireshark to capture the requests sent by the SSLLabs scanner to my server. I find that from some point, SSLLabs sends a large number of TLS 1.0 client hello handshakes with only two cipher suites (one is fixed to TLS_EMPTY_RENEGOTIATION_INFO_SCSV; another is an insecure or deprecated cipher). This phase lasts for more than 30 seconds. I guess SSLLabs is testing weather my server supports that deprecated cipher suite. Is there any reason that you don't combine these into one (or at least fewer) handshakes?\n\nI feel that you can greatly improve the performance if you send all of these cipher suites in one handshake, and if the server replies with a server hello, then you remove the negotiated cipher from your initial cipher suite list, and send client hello again. Repeat until the server says handshake failure, meaning no overlapped cipher suite. SSLLabs does scan it this way for TLS 1.2. Why not do the same for TLS 1.0?\n\n**Suggestion/Question 2**:\nCould you send a normal TLS handshake at the beginning of the scanning, so that you can catch if the server uses invalid certificate earlier?\n\nThanks!\n"},"comment":{"url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/comments/263542130","html_url":"https://github.com/ssllabs/ssllabs-scan/issues/362#issuecomment-263542130","issue_url":"https://api.github.com/repos/ssllabs/ssllabs-scan/issues/362","id":263542130,"user":{"login":"bhushan5640","id":6083185,"avatar_url":"https://avatars.githubusercontent.com/u/6083185?v=3","gravatar_id":"","url":"https://api.github.com/users/bhushan5640","html_url":"https://github.com/bhushan5640","followers_url":"https://api.github.com/users/bhushan5640/followers","following_url":"https://api.github.com/users/bhushan5640/following{/other_user}","gists_url":"https://api.github.com/users/bhushan5640/gists{/gist_id}","starred_url":"https://api.github.com/users/bhushan5640/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/bhushan5640/subscriptions","organizations_url":"https://api.github.com/users/bhushan5640/orgs","repos_url":"https://api.github.com/users/bhushan5640/repos","events_url":"https://api.github.com/users/bhushan5640/events{/privacy}","received_events_url":"https://api.github.com/users/bhushan5640/received_events","type":"User","site_admin":false},"created_at":"2016-11-29T11:06:53Z","updated_at":"2016-11-29T11:06:53Z","body":"Improved cipher suite testing now deployed on SSL Labs Dev."}}
{"actor":{"display_login":"bhushan5640"}}