Skip to content
Eon Insights
Tools
tlsscan

tlsscan

Purpose

tlsscan is a one-shot CLI that scans a single TLS/SSL endpoint for supported protocol versions, cipher suites, and known vulnerabilities, and prints the result to the terminal (or as JSON). It’s the same scan engine tlsscand runs as a queued worker, exposed directly for ad-hoc use — no ClickHouse or Redis connection required.

Usage 

tlsscan [options] [URL or HOST:PORT]
FlagDescription
-jsonOutput results in JSON format instead of formatted text
-debugEnable debug logging

The target can be given as a bare host:port, a hostname alone (defaults to port 443), or a full http:///https:// URL (port inferred from the scheme if not explicit).

What it checks

The formatted output covers:

  • Supported protocols and cipher suites per protocol, flagging the server’s preferred cipher and its key size/strength
  • Compression — whether TLS compression is enabled (CRIME attack exposure)
  • Renegotiation — supported and, if so, whether it’s secure
  • Fallback SCSV — protection against protocol downgrade attacks
  • Heartbleed — per-protocol-version vulnerability check
  • Supported elliptic curve/DH groups
  • Certificate chain details (subject, issuer, validity, SHA-256 fingerprint)

Examples 

tlsscan https://www.example.com
tlsscan https://www.example.com:8443
tlsscan www.example.com:443
tlsscan -json 8.8.8.8:443
nmapscandtlslab