From 09e0bca13331b9b57051827c4109b17254b536fc Mon Sep 17 00:00:00 2001
From: Ewoud Kohl van Wijngaarden <ewoud@kohlvanwijngaarden.nl>
Date: Tue, 30 Jun 2026 12:19:20 +0200
Subject: [PATCH] Add nmap test to verify TLS ciphers

---
 spec/acceptance/basic_spec.rb | 10 ++++++++++
 spec/setup_acceptance_node.pp |  5 +++++
 2 files changed, 15 insertions(+)

diff --git a/spec/acceptance/basic_spec.rb b/spec/acceptance/basic_spec.rb
index 68da1f758..c44bac1a6 100644
--- a/spec/acceptance/basic_spec.rb
+++ b/spec/acceptance/basic_spec.rb
@@ -10,4 +10,14 @@
   describe package('foreman-proxy-journald') do
     it { is_expected.not_to be_installed }
   end
+
+  describe command('nmap --script +ssl-enum-ciphers localhost -p 8443') do
+    its(:stdout) { should match(/TLSv1\.3/) }
+    its(:stdout) { should match(/TLSv1\.2/) }
+    its(:stdout) { should_not match(/TLSv1\.1/) }
+    its(:stdout) { should_not match(/TLSv1\.0/) }
+
+    # Test that the least cipher strength is "strong" or "A"
+    its(:stdout) { should match(/least strength: (A|strong)/) }
+  end
 end
diff --git a/spec/setup_acceptance_node.pp b/spec/setup_acceptance_node.pp
index 2b14f650a..acbc8c5c0 100644
--- a/spec/setup_acceptance_node.pp
+++ b/spec/setup_acceptance_node.pp
@@ -1,3 +1,8 @@
+# Used to test which TLS versions are enabled
+package { 'nmap':
+  ensure => installed,
+}
+
 class { 'foreman::repo':
   repo => 'nightly',
 }