Skip to content
Eon Insights
Tools
tlslab

tlslab

Purpose

tlslab is a TLS protocol simulator used to test capture, tlsscan, and nmapscand against controlled, reproducible TLS endpoints. It can serve deprecated protocols (SSLv2, SSLv3, TLS 1.0/1.1) alongside modern TLS 1.3, and supports 366+ cipher suites, so you can point the other tools at endpoints with a known-bad configuration and verify they detect it correctly — without touching a real host.

Usage 

tlslab -c <config.yaml> [-debug]
FlagDescription
-cPath to configuration file (required)
-debugEnable debug logging

Configuration 

name: tlslab
debug: false
cipher_groups:
  modern:
    - TLS_AES_128_GCM_SHA256
    - TLS_AES_256_GCM_SHA384
endpoints:
  - name: modern-tls13
    listen: ":4430"
    protocol: tls13
    ciphers: [modern]
    sni: ["modern.tls.test"]

Each entry under endpoints opens a listener on its own port with its own protocol version and cipher group — this is how devctl’s bundled tlslab config exposes ten endpoints (ports 4450–4459) covering the “recommended / secure / weak / insecure” security-profile hostnames that datagen -realistic generates. See configs/tlslab.yaml for a complete worked example.

Examples 

# Run the simulator
tlslab -c configs/tlslab.yaml

# Run with debug logging
tlslab -c configs/tlslab.yaml -debug

# Probe an endpoint with openssl
openssl s_client -connect localhost:4430 -servername modern.tls.test

# Probe with curl (and let `capture` observe the handshake)
curl -k https://localhost:4430/
tlsscandatagen