SSL/TLS Recommended Cipher Suites (PCI DSS)

#!/usr/bin/env bash
# Verify Tenable plugin 159543 — SSL/TLS Recommended Cipher Suites (PCI DSS)
# Usage: ./check_159543.sh <host> <port>
set -u
HOST="${1:-}"; PORT="${2:-443}"
if [[ -z "$HOST" ]]; then echo "Usage: $0 <host> <port>"; exit 2; fi

if ! command -v openssl >/dev/null 2>&1; then echo "UNKNOWN: openssl not installed"; exit 2; fi

# Mozilla intermediate / modern recommended list — anything else is a finding
RECOMMENDED='TLS_AES_128_GCM_SHA256 TLS_AES_256_GCM_SHA384 TLS_CHACHA20_POLY1305_SHA256 ECDHE-ECDSA-AES128-GCM-SHA256 ECDHE-RSA-AES128-GCM-SHA256 ECDHE-ECDSA-AES256-GCM-SHA384 ECDHE-RSA-AES256-GCM-SHA384 ECDHE-ECDSA-CHACHA20-POLY1305 ECDHE-RSA-CHACHA20-POLY1305 DHE-RSA-AES128-GCM-SHA256 DHE-RSA-AES256-GCM-SHA384 DHE-RSA-CHACHA20-POLY1305'

OFFERED=$(openssl s_client -connect "$HOST:$PORT" -servername "$HOST" -cipher 'ALL:!aNULL' </dev/null 2>/dev/null \
  | awk -F': ' '/Cipher    :/ {print $2}')

# Enumerate full list via cipher-by-cipher probe
FINDING=0; BAD_LIST=""
for C in $(openssl ciphers 'ALL:!aNULL:!eNULL' | tr ':' ' '); do
  RESULT=$(openssl s_client -connect "$HOST:$PORT" -servername "$HOST" -cipher "$C" </dev/null 2>/dev/null | grep -c 'Cipher    : '"$C"'$')
  if [[ "$RESULT" -gt 0 ]]; then
    if ! echo " $RECOMMENDED " | grep -q " $C "; then
      FINDING=1; BAD_LIST+="$C "
    fi
  fi
done

if [[ "$FINDING" -eq 1 ]]; then
  echo "VULNERABLE: $HOST:$PORT offers non-recommended cipher(s): $BAD_LIST"
  exit 1
else
  echo "PATCHED: $HOST:$PORT offers only Mozilla-recommended suites"
  exit 0
fi