Nmap currently does not support TLS 1.3

I started updating NSE to TLS 1.3 last year some time, but I haven't had as much time to work on it as I would have liked. That said, it is high on my priority list and I hope to have it finished by the next release (which will not take over a year like Nmap 7.80 did!).

Two more issues with that script. Compare:

https://www.ssllabs.com/ssltest/analyze.html?d=cloudflare.com

to

nmap --script ssl-enum-ciphers -p 443 www.cloudflare.com

The issues are:

1. The order of the 1.2 ciphers is not server-prefered. (the script says cipher preference: client)
2. Ciphers which SSL Labs lists as weak are reported as 'A' grade by the script.

@dmiller-nmap - Just checking, if you were able made to any progress last two months or so? Thanks for doing this!

@dmiller-nmap Im looking forward for tls 1.3 support too :)

Now, since TLS 1.2 has been considered as vulnerable, it's getting highly desirable to have TLS 1.3 support.

I would also like to see 1.3 support.

Now, since TLS 1.2 has been considered as vulnerable, it's getting highly desirable to have TLS 1.3 support.

Has TLS 1.2 already been considered as vulnerable?

Now, since TLS 1.2 has been considered as vulnerable, it's getting highly desirable to have TLS 1.3 support.

Has TLS 1.2 already been considered as vulnerable?

No, but TLS 1.3 is still the future an is already in use modern systems. A lot Websites don't support TLS 1.3 and more and more websites support TLS 1.2 & 1.3.

Now, since TLS 1.2 has been considered as vulnerable, it's getting highly desirable to have TLS 1.3 support.

Has TLS 1.2 already been considered as vulnerable?

TLS 1.2 in and of itself is not considered vulnerable at this time. Certain ciphers available in TLS 1.2 are vulnerable.
https://en.wikipedia.org/wiki/Transport_Layer_Security#Applications_and_adoption

I use nmap to perform part in my audit of systems but because it does not support TLS 1.3 I have to use other software to complete my audits where I could've simplified and use fewer tools.

SSL Labs successfully enumerates TLS 1.3 ciphers

However, from the command line, you need something like this:

openssl s_client -connect www.example.com:443 -tls1_3

To check only a specific TLSv1.3 cipher, use this:

openssl s_client -connect www.example.com:443 -tls1_3 -ciphersuites TLS_AES_256_GCM_SHA384
openssl s_client -connect www.example.com:443 -tls1_3 -ciphersuites TLS_CHACHA20_POLY1305_SHA256
openssl s_client -connect www.example.com:443 -tls1_3 -ciphersuites TLS_AES_128_GCM_SHA256

Here's a pretty good Bash implementation for TLSv1.3? https://gist.github.com/jahir/23c4202eee12e377ef3acf1dcdc7c776