tlsanalyzer

README

tlsanalyzer

tlsanalyzer It is a utility that takes inspiration from the original sslscan, with fewer features, but with the aim of being used in those work contexts where it is not permitted to install anything on your machines, or where you are not allowed access to the internet network.

This is early development version.

Roadmap:

• Timeout flag
• Print certificate chain
• Certificate Expiration check
• Save certificate chain on file
• Fix ordered test (go range behaviour)
• Check supported cipher
• Add the minimum version to start the scan from
• Improved performance (goroutines)
• Export report in markdown
• Project name change
• Github action for multiarch release
• force-cipher flag added to check all supported cipher
• Full build (shell)script

Building from source

If you want to build tlsanalyzer from source, please verify to have already installed go1.23.4 or higher.

Then run this command:

go build -v -ldflags="-X 'github.com/olelbis/tlsanalyzer/build.Version=$(cat VERSION)' -X 'github.com/olelbis/tlsanalyzer/build.BuildUser=Team tlsanalyzer' -X 'github.com/olelbis/tlsanalyzer/build.BuildTime=$(date)'" -o tlsanalyzer

How it works

Usage:

Usage: tlsanalyzer [--cert] [--checkcert] --host <host> [--port <portnumber>] [--timeout <sec>] [--output <file>] [--min-version 1.0|1.1|1.2|1.3]

Basic execution:

olelbis@mymachost tlsanalyzer % tlsanalyzer --host example.com                        

TLS Analisys for: [example.com:443]

👉 Trying version TLS 1.0 
❌ Handshake failed: remote error: tls: protocol version not supported

🚫 TLS 1.0: unsupported

👉 Trying version TLS 1.1 
❌ Handshake failed: remote error: tls: protocol version not supported

🚫 TLS 1.1: unsupported

👉 Trying version TLS 1.2 

✅ TLS 1.2: supported
   Negotiated Cipher suite: TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
   CN: *.example.com
   Issuer: DigiCert Global G3 TLS ECC SHA384 2020 CA1
   Valid: 2025-01-15T00:00:00Z - 2026-01-15T23:59:59Z
   DNS: [*.example.com example.com]
   Supported cipher suites:
     • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
     • TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
     • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256

👉 Trying version TLS 1.3 

✅ TLS 1.3: supported
   Negotiated Cipher suite: TLS_AES_256_GCM_SHA384
   CN: *.example.com
   Issuer: DigiCert Global G3 TLS ECC SHA384 2020 CA1
   Valid: 2025-01-15T00:00:00Z - 2026-01-15T23:59:59Z
   DNS: [*.example.com example.com]
   Supported cipher suites:
     • TLS_RSA_WITH_RC4_128_SHA
     • TLS_RSA_WITH_AES_128_CBC_SHA256
     • TLS_RSA_WITH_AES_256_CBC_SHA
     • TLS_AES_128_GCM_SHA256
     • TLS_CHACHA20_POLY1305_SHA256
     • TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
     • TLS_RSA_WITH_AES_256_GCM_SHA384
     • TLS_AES_256_GCM_SHA384
     • TLS_ECDHE_RSA_WITH_CHACHA20_POLY1305
     • TLS_RSA_WITH_AES_128_GCM_SHA256
     • TLS_RSA_WITH_3DES_EDE_CBC_SHA
     • TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
     • TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256
     • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256
     • TLS_RSA_WITH_AES_128_CBC_SHA
     • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256
     • TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384
     • TLS_ECDHE_ECDSA_WITH_CHACHA20_POLY1305
     • TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
     • TLS_ECDHE_ECDSA_WITH_AES_128_GCM_SHA256
     • TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
     • TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
     • TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
     • TLS_ECDHE_RSA_WITH_RC4_128_SHA
     • TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
     • TLS_AES_256_GCM_SHA384