Greenbone is not detecting the problem

[rippledj (Joseph)]

Sorry, I thought that NASL was using the openvas-scanner network functions under-the-hood. So, since the OP’s issue is described as :

vulnerarbility in the cipher suite also not detected.

The cause may be because NASL currently doesn’t pass a SNI in the Client Hello?

[cfi]

Yes, indeed. This was already explained / described back then in 2023 in the below linked posting.

Note that this is a huge and complex topic and not just about “Sending/passing SNI in the Client Hello and be done”.

Greenbone is not detecting the problem

Hello, and welcome to this community forums. This is currently the expected behavior: The SSL/TLS cipher and version determination is purely done via NASL based scripts and the code part is using the IP and not the hostname(s) of the target to query this information (technical: No SNI extension with the host name is sent). There is an internal task to improve / extend this functionality to use / sent the SNI extension in SSL/TLS requests. But as this is a hugely invasive task which can have …