Put a domain on subfinder. The audit checks at most 200 hosts on port 443.
Results
findings.jsonl. One row per weak host, plus a summary. Healthy certificates are counted in the summary.
How it works
subfinder lists hosts. handshake opens port 443 and records each completed certificate. expiry, hostname, and trust classify expiry, name mismatch, self-signed certs, untrusted chains, and legacy protocols.
Overview
A certificate error in a browser is a finding only if you can say which host failed and why. This workflow enumerates hosts and opens port 443. It classifies expiry, hostname mismatch, self-signed certificates, and untrusted chains from the verify error. It does not send an HTTP request and it does not accept the bad certificate in order to keep going. Point it at a domain you are authorised to test. Weak TLS belongs next to mail transport checks in exposure management, because both fail quietly after a deploy.
Pipeline
subfinder enumerates hosts for the domain you set.
handshake opens port 443 and records each completed certificate, on at most 200 hosts. A host that never completes a handshake is not a finding.
expiry, hostname, and trust classify expiry, name mismatch, self-signed certificates, untrusted chains, and legacy protocols.
report writes findings.jsonl, one row per weak host, plus a summary.
Inputs
Domain. Set on the subfinder node. Hosts come from that enumeration.
Outputs
findings.jsonl. One JSON line per host with a certificate or chain problem, plus a summary.
Integrations
Subfinder. Host enumeration for the domain.
Sample output
The row below is from a completed run on badssl.com on 2026-09-24. The run classified 200 hosts as weak. This is one of them.
host
state
protocol
issues
severity
scanned_at
sha1-2016.badssl.com
weak
TLSv1.2
certificate-expired, untrusted-chain
high
2026-09-24T10:15:16Z
FAQ
Does this crawl the website?
No. It opens port 443 and reads the handshake. It does not send application data.
Which problems are flagged?
Expired certificates, hostname mismatch, self-signed certificates, and untrusted chains.
How many hosts are checked?
At most 200 hosts from the subfinder output.
Where should I run it?
On a domain you are authorised to test.
Related workflows
Email Spoofing Scanner. Reach for this when the question is mail authentication rather than the certificate on port 443.