Mozilla TLS Scanner SDKs & Libraries: Development Tools

SDKs overview

The Mozilla TLS Scanner, officially known as the Mozilla TLS Observatory, is a public web service designed to assess and report on the TLS configurations of internet-facing servers. Unlike many APIs that offer direct SDKs for programmatic interaction, the Mozilla TLS Observatory operates as an external scanning service without a public API or conventional SDKs for direct integration into third-party applications. Its primary function is to provide an independent evaluation of server-side TLS security, aligning with Mozilla's comprehensive server-side TLS guidelines.

Developers seeking to incorporate Mozilla's stringent TLS security standards into their projects typically do so by implementing the recommended configurations directly within their server environments or by utilizing community-developed libraries that codify these guidelines. These community libraries translate Mozilla's best practices for TLS versions, cipher suites, and other related settings into actionable code, available across various programming languages. This approach allows developers to ensure their applications and infrastructure adhere to high security standards, as often validated by the Mozilla TLS Observatory itself.

The focus of this page is on these community-driven efforts and how they enable developers to align with Mozilla's security posture, rather than discussing direct SDKs for the scanner, which are not available. This includes examining libraries that help configure TLS clients and servers according to Mozilla's recommendations, providing a practical pathway for developers to enhance their application's security without directly embedding the scanner's functionality.

Official SDKs by language

As the Mozilla TLS Scanner (TLS Observatory) is a web-based diagnostic tool rather than a programmatic API, there are no official SDKs provided by Mozilla for direct integration into applications. The service is designed for external scanning and reporting, providing insights into a server's TLS configuration based on Mozilla's published guidelines. Therefore, the concept of an "official SDK" in the traditional sense does not apply to the Mozilla TLS Scanner itself.

However, Mozilla extensively publishes its TLS configuration recommendations. These guidelines are foundational for developers aiming to secure their applications and infrastructure. While not SDKs, these guidelines serve as a blueprint for implementing secure TLS, and numerous community projects have arisen to help developers apply these recommendations programmatically. These community efforts are discussed further in the Community libraries section.

Developers who wish to automate the process of checking their server configurations against Mozilla's guidelines can explore web scraping or API interaction with the results page of the Mozilla TLS Observatory, though this is outside the scope of official support and may be subject to changes in the Observatory's web interface. A more robust approach involves using tools that implement similar checks or allow for the programmatic configuration of TLS settings according to the Mozilla guidelines.

Installation

Since there are no official SDKs for the Mozilla TLS Scanner, there is no direct installation process for embedding its functionality. The Mozilla TLS Observatory is a public web service that users access via a web browser to scan a domain. For example, a user would navigate to the Mozilla TLS Observatory website, enter a domain name, and initiate a scan to receive a detailed report on its TLS configuration.

For developers looking to implement Mozilla's TLS recommendations, installation steps involve integrating community libraries or configuring server software directly. These steps vary significantly by programming language and server environment. Below are general approaches to "installation" when working with Mozilla's TLS security principles:

• Server Configuration: Manually configure web servers (e.g., Apache, Nginx, IIS) or application servers to align with Mozilla's Server Side TLS guidelines. This involves editing configuration files to specify supported TLS protocols, cipher suites, curves, and other security parameters. The Mozilla Wiki provides detailed recommended configurations for various server software.
• Programming Language-Specific Libraries: Install and integrate community-developed libraries that encapsulate Mozilla's TLS recommendations. These libraries are typically installed using standard package managers for their respective languages (e.g., pip for Python, npm for Node.js, Maven or Gradle for Java).
• Infrastructure as Code (IaC) Tools: Utilize tools like Ansible, Puppet, Chef, or Terraform to automate the deployment of server configurations that adhere to Mozilla's guidelines across multiple servers. This ensures consistency and reduces manual error.

These methods enable developers to implement the security best practices that the Mozilla TLS Scanner evaluates, effectively "installing" the principles rather than the scanner itself.

Quickstart example

Given the absence of official SDKs for the Mozilla TLS Scanner, a quickstart example focuses on implementing Mozilla's TLS recommendations using a representative community library. For illustration, we will use a hypothetical Python library that helps generate server-side TLS configurations based on Mozilla's guidelines. This approach mirrors how developers would adopt Mozilla's security posture programmatically.

Scenario: Generating a secure Nginx TLS configuration snippet based on Mozilla's "Modern" compatibility profile.

# This is a conceptual example using a hypothetical library.
# In a real scenario, you would use a specific community library
# or configuration management tool that implements these guidelines.

import os

def generate_mozilla_tls_config(profile="Modern"):
    """
    Generates a server-side TLS configuration snippet based on Mozilla's guidelines.
    This is a simplified, illustrative function.
    Real implementations would involve more complex logic and data structures.
    """
    config_snippets = {
        "Modern": """
ssl_protocols TLSv1.3;
ssl_ciphers TLS_AES_256_GCM_SHA384:TLS_CHACHA20_POLY1305_SHA256:TLS_AES_128_GCM_SHA256;
ssl_prefer_server_ciphers off;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1h;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;
""",
        "Intermediate": """
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers on;
ssl_session_cache shared:SSL:10m;
ssl_session_timeout 1h;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;
add_header X-Frame-Options DENY always;
add_header X-Content-Type-Options nosniff always;
""",
        # ... other profiles like 'Old' would be here
    }

    if profile not in config_snippets:
        raise ValueError(f"Invalid profile: {profile}. Choose from {list(config_snippets.keys())}")

    return config_snippets[profile]

# --- Usage Example ---11
if __name__ == "__main__":
    try:
        modern_nginx_config = generate_mozilla_tls_config("Modern")
        print("--- Mozilla (Modern) Nginx TLS Configuration ---")
        print(modern_nginx_config)

        # Example of writing to a file (e.g., for Nginx include)
        config_filename = "nginx_tls_modern.conf"
        with open(config_filename, "w") as f:
            f.write(modern_nginx_config)
        print(f"Configuration written to {config_filename}")

        # To apply this, you would include this file in your Nginx configuration:
        # e.g., in nginx.conf or a site-specific config:
        # include /etc/nginx/snippets/nginx_tls_modern.conf;

    except ValueError as e:
        print(f"Error: {e}")

This example demonstrates how a developer might use a programmatic approach to create configurations aligned with Mozilla's Server Side TLS guidelines. In a real-world scenario, the generate_mozilla_tls_config function would likely call a library that fetches the latest recommended configurations, validates parameters, and potentially integrates with a configuration management system.

After generating and applying such a configuration, you could then use the Mozilla TLS Observatory to scan your server and verify adherence to the chosen profile.

Community libraries

While Mozilla does not provide direct SDKs for its TLS Scanner, the comprehensive Mozilla Server Side TLS guidelines have inspired a variety of community-driven tools and libraries across different programming languages. These resources help developers implement and enforce Mozilla's recommended TLS configurations in their applications and infrastructure. The following table provides examples of such community efforts, which are generally independent and not officially endorsed or maintained by Mozilla, but draw heavily from its security principles.

These community resources play a vital role in bridging the gap between Mozilla's broad security recommendations and their practical implementation by developers. They allow for the programmatic application, testing, and maintenance of secure TLS configurations, which can then be validated by external scanners like the Mozilla TLS Observatory or Qualys SSL Labs SSL Test. Developers should always verify the current relevance and maintenance status of any third-party library before integrating it into production systems, as TLS standards evolve frequently, as noted in the IETF's RFC 8446 for TLS 1.3.