security enabled verified low v1.0.0

testssl.sh

Shell script for TLS/SSL testing that checks protocol support, cipher suites, certificate issues, and known vulnerabilities on any TLS server.

📋 Live Preview

testssl.sh {flag-quiet} {flag-color} {flag-severity} {flag-protocols} {flag-ciphers} {flag-json} {flag-html} {flag-csv} {flag-starttls} {target}

📎 flag-quiet 📎 flag-color 📎 flag-severity 📎 flag-protocols 📎 flag-ciphers 📎 flag-json 📎 flag-html 📎 flag-csv 📎 flag-starttls 📎 target

testssl.sh {flag-quiet} {flag-color} {flag-severity} {flag-protocols} {flag-ciphers} {flag-json} {flag-html} {flag-csv} {flag-starttls} {target}

Sandbox: execFile · Timeout: 300s

Capabilities

tls.scan.certificate

tls.scan.cipher

tls.scan.protocol

tls.scan.vulnerability

tls.scan.heartbleed

Parameters

Name	Type	Required	Default	Description	Aliases
`target`	string	Yes	-	Target URI, hostname, or IP (optionally with port)	-
`flag-uri`	string	No	-	Auto-detect port (https://host, ftps://host, etc.)	`--uri`
`flag-json`	boolean	No	-	Output in JSON format	`--jsonfile`
`flag-html`	boolean	No	-	Output in HTML format	`--htmlfile`
`flag-csv`	boolean	No	-	Output in CSV format	`--csvfile`
`flag-severity`	string	No	-	Only display findings of severity (LOW, MEDIUM, HIGH, CRITICAL)	`--severity`
`flag-quiet`	boolean	No	-	Quiet mode, less verbose output	`--quiet`
`flag-color`	boolean	No	-	Force colored output	`--color`
`flag-starttls`	string	No	-	STARTTLS protocol (smtp, ftp, imap, pop3, xmpp, etc.)	`--starttls`
`flag-protocols`	boolean	No	-	Check only protocol support	`--protocols`
`flag-ciphers`	boolean	No	-	Check only cipher suites	`--ciphers`

Artifacts

Type	Description	MIME	Schema	Trust
`report.json`	TLS scan results as JSON	application/json	-	verified
`report.html`	TLS scan results as HTML	text/html	-	verified
`report.csv`	TLS scan results as CSV	text/csv	-	verified

Contract

Inputs

network.target.host

Target hostname or IP address

network.port

Target port (default 443)

Outputs

report.json

Scan results in JSON

report.html

Scan results in HTML

report.csv

Scan results in CSV

Side effects: network_traffic

Workflow Edges

Produces

report.jsonreport.htmlreport.csv

Consumes

network.target.hostnetwork.port

Resource Profile

Resource	Value
CPU	low
Memory	64 MB
Network	medium
Disk I/O	low

Examples

Basic TLS scan

testssl.sh example.com

Scan with JSON and HTML output

testssl.sh --jsonfile scan.json --htmlfile scan.html example.com

Quick check for protocol support only

testssl.sh --protocols example.com

Check STARTTLS SMTP

testssl.sh --starttls smtp mail.example.com:25

Scan with severity filter

testssl.sh --severity HIGH example.com

Documentation

testssl.sh — TLS/SSL Testing Tool

testssl.sh is a free command-line tool that checks a server's TLS/SSL configuration for protocol support, cipher suites, certificate issues, and known vulnerabilities. Written as a shell script, it requires only bash and openssl.

Usage

# Basic scan
testssl.sh example.com

# Output to JSON and HTML
testssl.sh --jsonfile scan.json --htmlfile scan.html example.com

# Check only protocols
testssl.sh --protocols example.com:8443

# Check STARTTLS
testssl.sh --starttls ftp ftp.example.com:21