Skip to content
ZK
ZAIN KHALIL KHAN
PORTFOLIO
All projects

Interactive build

TLS Inspector | Transport Posture Grading

Transport security grader that evaluates offered protocol versions, cipher suite properties, key type and size, certificate expiry and chain completeness, HSTS strength, and OCSP stapling, producing a letter grade with a named mechanism and fix per finding.

Live demo readyTLS + Cryptography
TLSCryptographyCertificate ManagementSecurity HardeningHSTSNetwork SecurityCase study / interactive demo

Case study

From problem to working system

Problem

Transport security grader that evaluates offered protocol versions, cipher suite properties, key type and size, certificate expiry and chain completeness, HSTS strength, and OCSP stapling, producing a letter grade with a named mechanism and fix per finding.

My role

Security engineer and full-stack developer

Solution

Transport security grader that evaluates offered protocol versions, cipher suite properties, key type and size, certificate expiry and chain completeness, HSTS strength, and OCSP stapling, producing a letter grade with a named mechanism and fix per finding.

Architecture

The implementation combines the following technologies and system concerns.

TLSCryptographyCertificate ManagementSecurity HardeningHSTSNetwork Security

How it was built

  • Graded negotiated crypto, certificate hygiene, and transport policy as three separate concerns, because they fail independently and get fixed by different teams.
  • Flagged cipher suites lacking forward secrecy separately from CBC-mode suites lacking AEAD, since the first exposes captured traffic and the second exposes padding-oracle classes.
  • Detected deprecated TLS 1.0 and 1.1 as high findings with the compliance consequence stated, rather than as a generic warning.
  • Checked chain completeness, since a missing intermediate fails validation only for clients without a cached copy, which is what makes it hard to reproduce.

Security decisions

  • Checked chain completeness, since a missing intermediate fails validation only for clients without a cached copy, which is what makes it hard to reproduce.

Major challenges

  • Graded negotiated crypto, certificate hygiene, and transport policy as three separate concerns, because they fail independently and get fixed by different teams.
  • Flagged cipher suites lacking forward secrecy separately from CBC-mode suites lacking AEAD, since the first exposes captured traffic and the second exposes padding-oracle classes.
  • Detected deprecated TLS 1.0 and 1.1 as high findings with the compliance consequence stated, rather than as a generic warning.

Verified evidence

Results and measurable impact

  • Detected deprecated TLS 1.0 and 1.1 as high findings with the compliance consequence stated, rather than as a generic warning.
  • Checked chain completeness, since a missing intermediate fails validation only for clients without a cached copy, which is what makes it hard to reproduce.
  • Evaluated HSTS max-age, subdomain inclusion, and preload eligibility instead of treating the header as present or absent.
  • Attached the specific remediation to every finding, naming the mechanism rather than advising to 'harden TLS'.

No separate numeric outcome is documented, so this section shows shipped technical evidence without inventing metrics.

Screenshots and access

Product view

Open live project

Interactive Demo

A scoped, fully functional recreation of this project's core feature runs below, live in your browser. Reset it, resize it, or expand it to full screen.

TLS Inspector

Security platform

TLS InspectorWorkspace2 updates
TLS Inspector · Transport Postureapp.example.com transport posture
grade A+

Transport posture is three separate questions: what crypto is negotiated, whether the certificate is trustworthy and current, and whether the transport policy closes the downgrade window. Each finding below names the mechanism at fault and what to change, since 'enable TLS 1.3' is advice and 'you still offer CBC suites without forward secrecy' is a finding.

Posture0 findings
A+100/100
Negotiated parameters
ProtocolsTLS1.3 · TLS1.2KeyECDSA 256SignatureSHA256withECDSAExpires62 daysChaincompleteHSTS730d · preload
Cipher suites offered
TLS_AES_256_GCM_SHA384ECDHE-RSA-AES128-GCM-SHA256
Findings0 findings

No findings. Modern protocols only, AEAD suites with forward secrecy, a complete chain, and HSTS with a year-long max-age.

Zain Khalil Khan