tlsscand

Purpose

tlsscand is a worker daemon that processes queued TLS scan tasks — actively connecting to a target host and probing its supported TLS versions, cipher suites, and certificate chain (the same scan logic as the standalone tlsscan CLI, but running as a pool of workers pulling from Redis). Tasks are enqueued by hostsync for newly discovered hosts, or by the dashboard/API (POST /api/hosts/{uuid}/tlsscan).

Usage

tlsscand -c <config.yaml> [-debug]

Configuration

tlsscand.yaml:

name: tlsscand
clickhouse:
  host: localhost
  port: 19000
  database: insights
  username: <clickhouse-user>
  password: "<clickhouse-password>"
redis:
  host: localhost
  port: 6379
  password: "<redis-password>"   # Redis AUTH is required
debug: false
concurrency: 5        # max concurrent scans, default 5 if unset/0
scan_interval: 24h     # minimum time between re-scans of the same host, e.g. 1h, 24h, 7d

If scan_interval is left empty, every queued task triggers a scan regardless of when the host was last scanned; set it in production. On startup, tlsscand checks the database schema and loads the capture settings (for internal-network classification) and scanner settings configured in the dashboard.

Example

# Run as a daemon with a config file
tlsscand -c tlsscand.yaml

# Run with debug logging
tlsscand -c tlsscand.yaml -debug