Which vulnerabilities can sslyze test for?

Heartbleed (--heartbleed), the OpenSSL CCS injection flaw CVE-2014-0224 (--openssl_ccs), ROBOT (--robot), insecure and client-initiated renegotiation (--reneg), CRIME-enabling TLS compression (--compression), and downgrade protection via TLS_FALLBACK_SCSV (--fallback).

Can sslyze scan many hosts at once?

Yes. Supply a targets file with one host:port per line through --targets_in and sslyze scans them concurrently into one result set, which suits automated TLS scanning across a whole estate.

Does sslyze work with mail and other STARTTLS protocols?

Yes. Use --starttls with smtp, imap, pop3, xmpp, ftp, ldap, rdp, or postgres, or auto to deduce the protocol from the port. That lets you scan mail and database front ends, not only HTTPS servers.

How does the Mozilla configuration check work?

The --mozilla_config flag grades the server against a published Mozilla TLS baseline (intermediate by default, or modern and old). It queues the scan commands the baseline needs and reports a clear pass or fail. Set it to disable to skip the check.

Can sslyze write machine-readable output?

The upstream CLI supports a JSON report through --json_out, which helps when parsing results in code. That flag is not exposed on the Trickest node; instead the node writes a file and a folder that downstream nodes read directly.

Updated Jul 15, 2026

Scanners

Scan a server's SSL/TLS setup for weak protocols and known bugs

A fast and powerful SSL/TLS scanner.

Audit a server's TLS configuration Test for named TLS vulnerabilities Validate certificate trust

overview

What sslyze does

sslyze inspects how a server negotiates SSL and TLS. Point it at a host and it reports which protocol versions the server accepts, the certificate chain and its validity, the supported cipher suites and elliptic curves, and whether downgrade and session-resumption protections are in place.

It also probes named weaknesses directly: Heartbleed, the OpenSSL CCS injection flaw, ROBOT, insecure renegotiation, and CRIME-enabling compression. The Mozilla configuration check grades a server against a published baseline, which turns a scan into a clear pass or fail against a known standard.

Reach for sslyze when you need an accurate, structured read of TLS posture rather than a quick banner grab. On Trickest it runs as a Scanners node that takes a target or a targets file and writes a file and a folder of results, so TLS findings flow into the same reporting as the rest of a scan.

source github.com/nabla-c0d3/sslyze

use cases

Where sslyze fits

Audit a server's TLS configuration

Check which protocol versions, ciphers, and curves a host accepts to flag legacy SSL 2.0/3.0 and weak TLS 1.0/1.1 support.

Test for named TLS vulnerabilities

Probe directly for Heartbleed, CCS injection, ROBOT, insecure renegotiation, and compression-based CRIME exposure.

Validate certificate trust

Retrieve and analyze the certificate chain to confirm validity, expiry, and trust against a CA bundle.

Check against a Mozilla baseline

Compare the server's TLS setup to a Mozilla recommended configuration for a clear pass or fail across a fleet of hosts.

reference

sslyze inputs and flags

32 inputs

Name	Type	Flag	Description
target	STRING	·	The server to scan, as host or host:port.
targets-in	FILE	--targets_in	Read targets from a file, one host:port per line.
certinfo	BOOLEAN	--certinfo	Retrieve and analyze the server's certificate(s) to verify validity.
heartbleed	BOOLEAN	--heartbleed	Test the server for the OpenSSL Heartbleed vulnerability.
robot	BOOLEAN	--robot	Test the server for the ROBOT vulnerability.
mozilla-config	STRING	--mozilla_config	Check TLS config against a Mozilla baseline (intermediate by default; disable to skip).
starttls	STRING	--starttls	Perform a StartTLS handshake (auto, smtp, xmpp, pop3, imap, ftp, ldap, rdp, postgres).
sni	STRING	--sni	Server Name Indication hostname to connect to (TLS 1.0+ only).

Showing key inputs. sslyze exposes 32 inputs in total.

Full flag reference (32 inputs)

Name	Type	Flag	Description
key	FILE	--key	Client private key file.
sni	STRING	--sni	Server Name Indication hostname to connect to, affecting TLS 1.0+ connections only.
cert	FILE	--cert	Client certificate chain in PEM format, sorted from the subject's client certificate through any intermediate CA certificates.
pass	STRING	--pass	Client private key passphrase.
quiet	BOOLEAN	--quiet	Do not output anything to stdout.
reneg	BOOLEAN	--reneg	Test the server for insecure TLS renegotiation and client-initiated renegotiation.
resum	BOOLEAN	--resum	Test the server for TLS 1.2 session resumption support using session IDs and TLS tickets.
robot	BOOLEAN	--robot	Test the server for the ROBOT vulnerability.
sslv2	BOOLEAN	--sslv2	Test the server for SSL 2.0 support.
sslv3	BOOLEAN	--sslv3	Test the server for SSL 3.0 support.
tlsv1	BOOLEAN	--tlsv1	Test the server for TLS 1.0 support.
target	STRING	·	The server to scan, as host or host:port.
keyform	STRING	--keyform	Client private key format: DER or PEM (default).
tlsv1-1	BOOLEAN	--tlsv1_1	Test the server for TLS 1.1 support.
tlsv1-2	BOOLEAN	--tlsv1_2	Test the server for TLS 1.2 support.
tlsv1-3	BOOLEAN	--tlsv1_3	Test the server for TLS 1.3 support.
xmpp-to	STRING	--xmpp_to	Hostname for the 'to' attribute of the XMPP stream when using STARTTLS XMPP. Defaults to the server's hostname.
certinfo	BOOLEAN	--certinfo	Retrieve and analyze the server's certificate(s) to verify validity.
fallback	BOOLEAN	--fallback	Test the server for the TLS_FALLBACK_SCSV mechanism that prevents downgrade attacks.
starttls	STRING	--starttls	Perform a StartTLS handshake: auto, smtp, xmpp, xmpp_server, pop3, imap, ftp, ldap, rdp, or postgres. auto deduces the protocol from the port.
early-data	BOOLEAN	--early_data	Test the server for TLS 1.3 early data support.
heartbleed	BOOLEAN	--heartbleed	Test the server for the OpenSSL Heartbleed vulnerability.
targets-in	FILE	--targets_in	Read the list of targets to scan from a file, one host:port per line.
compression	BOOLEAN	--compression	Test the server for TLS compression support, which can enable a CRIME attack.
openssl-ccs	BOOLEAN	--openssl_ccs	Test the server for the OpenSSL CCS injection vulnerability (CVE-2014-0224).
http-headers	BOOLEAN	--http_headers	Test the server for the presence of security-related HTTP headers.
https-tunnel	STRING	--https_tunnel	Tunnel traffic through an HTTP CONNECT proxy at 'http://USER:PW@HOST:PORT/'. Only Basic authentication is supported.
mozilla-config	STRING	--mozilla_config	Queue the scan commands to grade the server against a Mozilla recommended TLS configuration. Defaults to intermediate; set disable to skip.
resum-attempts	STRING	--resum_attempts	Used with --resum. Number of session resumptions to attempt (default 5); a higher value like 100 gives a more accurate success rate.
elliptic-curves	BOOLEAN	--elliptic_curves	Test the server for supported elliptic curves.
slow-connection	BOOLEAN	--slow_connection	Reduce the number of concurrent connections for slower but more reliable scans over slow links or fragile servers.
certinfo-ca-file	FILE	--certinfo_ca_file	Used with certinfo. PEM file of root certificates to verify the server certificate's validity.

example

Run sslyze

sslyze · command

# TLS scan of one host: certificate, Heartbleed, ROBOT, and Mozilla baselinesslyze --certinfo --heartbleed --robot --mozilla_config=intermediate example.com:443

sample output

 SCAN RESULTS FOR EXAMPLE.COM:443 - 198.51.100.23 ------------------------------------------------ * SSL 2.0 Cipher Suites:  The server rejected all cipher suites. * TLS 1.2 Cipher Suites:  The server accepted 5 cipher suites. * TLS 1.3 Cipher Suites:  The server accepted 3 cipher suites. * Heartbleed:  OK - Not vulnerable to Heartbleed. * ROBOT Attack:  OK - Not vulnerable, no oracle detected. * Certificate Information:  Trusted chain, leaf expires 2027-01-14. COMPLIANCE AGAINST MOZILLA TLS CONFIGURATION (intermediate): OK - Compliant.

guidance

Choosing sslyze

Use sslyze when you need a deep, accurate read of a server's TLS posture, including named vulnerabilities and a Mozilla baseline check. For a quick liveness-plus-tech probe across many hosts, httpx is lighter. Feed sslyze hosts from discovery and probing for full-estate TLS coverage.

testssl.sh

Thorough shell-based TLS scanner. sslyze is faster across many hosts and emits cleaner structured output.

tlsx

Fast TLS grabber for wide scopes. sslyze goes deeper on vulnerabilities and config baselines.

faq

sslyze questions

Point sslyze at a host or host:port and it reports the accepted protocol versions, cipher suites, elliptic curves, and certificate chain. Add scan commands like --certinfo, --heartbleed, or --mozilla_config to widen the checks. On Trickest, set the node's target input instead of passing the host on a command line.

Run sslyze yourself

A host list is probed by httpx, then sslyze scans the live servers' TLS configuration and writes the report as output.

Run sslyze in Trickest View the workflow

Facts on this page come from the live Trickest tool library.

Name

Type

Flag

Description

target

STRING

The server to scan, as host or host:port.

targets-in

FILE

--targets_in

Read targets from a file, one host:port per line.

certinfo

BOOLEAN

--certinfo

Retrieve and analyze the server's certificate(s) to verify validity.

heartbleed

BOOLEAN

--heartbleed

Test the server for the OpenSSL Heartbleed vulnerability.

robot

BOOLEAN

--robot

Test the server for the ROBOT vulnerability.

mozilla-config

STRING

--mozilla_config

Check TLS config against a Mozilla baseline (intermediate by default; disable to skip).

starttls

STRING

--starttls

Perform a StartTLS handshake (auto, smtp, xmpp, pop3, imap, ftp, ldap, rdp, postgres).

sni

STRING

--sni

Server Name Indication hostname to connect to (TLS 1.0+ only).

Name

Type

Flag

Description

key

FILE

--key

Client private key file.

sni

STRING

--sni

Server Name Indication hostname to connect to, affecting TLS 1.0+ connections only.

cert

FILE

--cert

Client certificate chain in PEM format, sorted from the subject's client certificate through any intermediate CA certificates.

pass

STRING

--pass

Client private key passphrase.

quiet

BOOLEAN

--quiet

Do not output anything to stdout.

reneg

BOOLEAN

--reneg

Test the server for insecure TLS renegotiation and client-initiated renegotiation.

resum

BOOLEAN

--resum

Test the server for TLS 1.2 session resumption support using session IDs and TLS tickets.

robot

BOOLEAN

--robot

Test the server for the ROBOT vulnerability.

sslv2

BOOLEAN

--sslv2

Test the server for SSL 2.0 support.

sslv3

BOOLEAN

--sslv3

Test the server for SSL 3.0 support.

tlsv1

BOOLEAN

--tlsv1

Test the server for TLS 1.0 support.

target

STRING

The server to scan, as host or host:port.

keyform

STRING

--keyform

Client private key format: DER or PEM (default).

tlsv1-1

BOOLEAN

--tlsv1_1

Test the server for TLS 1.1 support.

tlsv1-2

BOOLEAN

--tlsv1_2

Test the server for TLS 1.2 support.

tlsv1-3

BOOLEAN

--tlsv1_3

Test the server for TLS 1.3 support.

xmpp-to

STRING

--xmpp_to

Hostname for the 'to' attribute of the XMPP stream when using STARTTLS XMPP. Defaults to the server's hostname.

certinfo

BOOLEAN

--certinfo

Retrieve and analyze the server's certificate(s) to verify validity.

fallback

BOOLEAN

--fallback

Test the server for the TLS_FALLBACK_SCSV mechanism that prevents downgrade attacks.

starttls

STRING

--starttls

Perform a StartTLS handshake: auto, smtp, xmpp, xmpp_server, pop3, imap, ftp, ldap, rdp, or postgres. auto deduces the protocol from the port.

early-data

BOOLEAN

--early_data

Test the server for TLS 1.3 early data support.

heartbleed

BOOLEAN

--heartbleed

Test the server for the OpenSSL Heartbleed vulnerability.

targets-in

FILE

--targets_in

Read the list of targets to scan from a file, one host:port per line.

compression

BOOLEAN

--compression

Test the server for TLS compression support, which can enable a CRIME attack.

openssl-ccs

BOOLEAN

--openssl_ccs

Test the server for the OpenSSL CCS injection vulnerability (CVE-2014-0224).

http-headers

BOOLEAN

--http_headers

Test the server for the presence of security-related HTTP headers.

https-tunnel

STRING

--https_tunnel

Tunnel traffic through an HTTP CONNECT proxy at 'http://USER:PW@HOST:PORT/'. Only Basic authentication is supported.

mozilla-config

STRING

--mozilla_config

Queue the scan commands to grade the server against a Mozilla recommended TLS configuration. Defaults to intermediate; set disable to skip.

resum-attempts

STRING

--resum_attempts

Used with --resum. Number of session resumptions to attempt (default 5); a higher value like 100 gives a more accurate success rate.

elliptic-curves

BOOLEAN

--elliptic_curves

Test the server for supported elliptic curves.

slow-connection

BOOLEAN

--slow_connection

Reduce the number of concurrent connections for slower but more reliable scans over slow links or fragile servers.

certinfo-ca-file

FILE

--certinfo_ca_file

Used with certinfo. PEM file of root certificates to verify the server certificate's validity.

SCAN RESULTS FOR EXAMPLE.COM:443 - 198.51.100.23 ------------------------------------------------ * SSL 2.0 Cipher Suites: The server rejected all cipher suites. * TLS 1.2 Cipher Suites: The server accepted 5 cipher suites. * TLS 1.3 Cipher Suites: The server accepted 3 cipher suites. * Heartbleed: OK - Not vulnerable to Heartbleed. * ROBOT Attack: OK - Not vulnerable, no oracle detected. * Certificate Information: Trusted chain, leaf expires 2027-01-14. COMPLIANCE AGAINST MOZILLA TLS CONFIGURATION (intermediate): OK - Compliant.

Scan a server's SSL/TLS setup for weak protocols and known bugs

What sslyze does

Where sslyze fits

Audit a server's TLS configuration

Test for named TLS vulnerabilities

Validate certificate trust

Check against a Mozilla baseline

sslyze inputs and flags

Run sslyze

Choosing sslyze

testssl.sh

tlsx

sslyze questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run sslyze yourself

Scan a server's SSL/TLS setup for weak protocols and known bugs

What sslyze does

Where sslyze fits

Audit a server's TLS configuration

Test for named TLS vulnerabilities

Validate certificate trust

Check against a Mozilla baseline

sslyze inputs and flags

Run sslyze

Choosing sslyze

testssl.sh

tlsx

sslyze questions

More Scanners tools

airixss

alterx

bomber

broken-link-checker

chopchop

cmseek

Run sslyze yourself