tlsscand

Purpose

tlsscand is an asynq worker daemon that processes queued TLS scan tasks — actively connecting to a target host and probing its supported TLS versions, cipher suites, and certificate chain (the same scan logic as the standalone tlsscan CLI, but running as a pool of workers pulling from Redis). Tasks are enqueued by hostsync for newly discovered hosts, or by the dashboard/API (POST /api/hosts/{uuid}/tlsscan).

Usage

tlsscand -c <config.yaml> [-debug]

Flag	Default	Description
`-c`	—	Path to config file (required)
`-debug`	`false`	Enable debug logging

Configuration

configs/tlsscand.yaml:

name: tlsscand
clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: insights
  password: secret
redis:
  host: localhost
  port: 6379
debug: false
concurrency: 5        # max concurrent scans, default 5 if unset/0
scan_interval: 24h     # minimum time between re-scans of the same host, e.g. 1h, 24h, 7d

If scan_interval is left empty, every queued task triggers a scan regardless of when the host was last scanned. On startup, tlsscand validates that the tls_scans and certificates tables exist, and loads the capture config (for internal-network classification) and scanner config from ClickHouse.

Example

# Run as a daemon with a config file
tlsscand -c configs/tlsscand.yaml

# Run with debug logging
tlsscand -c configs/tlsscand.yaml -debug

hostsync nmapscand