Build TLS protocol configuration inventory

Proprietary

Inventories every place a codebase decides which TLS protocol versions and cipher suites may be negotiated — Java sources and Spring Boot .properties/.yaml files — and classifies each by whether TLS 1.3, the only version JEP 527 hybrid key exchange exists for, remains reachable. A pinned cipher list with no RFC 8446 suite blocks TLS 1.3 even when the protocol floor allows it. Deliberately excludes the taint-tracking discovery recipes that overlap this surface (FindHardcodedProtocolChoice, FindDirectSSLConfigurationEditing, FindSSLContextSetDefault): they answer "is this value hardcoded?", this answers "is TLS 1.3 still reachable?", and running both doubles every finding.

io.moderne.cryptography.pqc.BuildTlsConfigurationInventory
mod run . --recipe=io.moderne.cryptography.pqc.BuildTlsConfigurationInventory

Install it once from Recipe actions, then run it on every repository under the current directory. New to the Moderne CLI? Set it up.

Recipe list

It runs these recipes, in this order.

  1. Find TLS protocol configuration
  2. Find TLS protocol configuration in properties and YAML