Recon
Collect TLS certificates, SANs, and fingerprints
TLS grabber for certificates, SANs, and JARM or JA3 fingerprints.
overview
What tlsx does
Feed -host or -list after httpx or dnsx surfaces live names. Set -port when TLS is not on 443. Certificate and fingerprint data write to FILE and FOLDER for downstream filtering.
Operators reach for it when live hosts need cert fields, negotiated versions, ciphers, or JARM and JA3 hashes. Enable -san or -cn to mine names; -json keeps each probe as a filterable record.
It is a grabber, not a deep protocol auditor. Pair with httpx for HTTP context, or use sslscan when you need richer per-host cipher and protocol analysis.
use cases
Where tlsx fits
Mine certificate SANs for new hosts
Enable -san on a live host list so Subject Alternative Names expand the attack surface inventory.
Fingerprint TLS stacks with JARM
Add -jarm to group hosts by TLS implementation and spot outliers that share the same stack.
Bulk grab certs across a port list
Point -list and -port at many hosts so certificate and version data land in one JSONL stream.
Find expired or self-signed certificates
Use -expired or -self-signed filters to highlight hosts with weak or neglected TLS posture.
reference
tlsx inputs and flags
| Name | Type | Flag | Description |
|---|---|---|---|
| host | STRING | -host | Target host or hosts to scan, comma-separated. |
| list | FILE | -list | File of targets to scan. |
| port | STRING | -port | Target port to connect (default 443). |
| subject-alternative-names | BOOLEAN | -san | Display subject alternative names from certificates. |
| jarm | BOOLEAN | -jarm | Display JARM fingerprint hash. |
| json | BOOLEAN | -json | Write output in JSON format. |
| silent | BOOLEAN | -silent | Display silent output. |
| concurrency | STRING | -concurrency | Number of concurrent threads (default 300). |
Showing key inputs. tlsx exposes 53 inputs in total.
Full flag reference (53 inputs)
| Name | Type | Flag | Description |
|---|---|---|---|
| dns | BOOLEAN | -dns | display unique hostname from SSL certificate response |
| ja3 | BOOLEAN | -ja3 | display ja3 fingerprint hash (using ztls) |
| sni | STRING | -sni | tls sni hostname to use |
| hash | BOOLEAN | -hash | display certificate fingerprint hashes (md5,sha1,sha256) |
| host | STRING | -host | target host(s) to scan (comma-separated) |
| jarm | BOOLEAN | -jarm | display jarm fingerprint hash |
| json | BOOLEAN | -json | json format output |
| list | FILE | -list | target list to scan |
| port | STRING | -port | target port to connect (default 443) |
| delay | STRING | -delay | duration to wait between each connection per thread (eg: 200ms, 1s) |
| retry | STRING | -retry | number of retries to perform for failures (default 3) |
| cacert | FILE | -cacert | client certificate authority file |
| cipher | BOOLEAN | -cipher | display used cipher |
| config | FILE | -config | tlsx configuration file |
| serial | BOOLEAN | -serial | display certificate serial number |
| silent | BOOLEAN | -silent | display silent output |
| expired | BOOLEAN | -expired | display validity status of certificate |
| revoked | BOOLEAN | -revoked | display host with revoked certificate |
| timeout | STRING | -timeout | tls connection timeout in seconds (default 5) |
| verbose | BOOLEAN | -verbose | display verbose output |
| hardfail | BOOLEAN | -hardfail | strategy to use if encountered errors while checking revocation status |
| resolvers | FILE | -resolvers | list of resolvers to use |
| resp-only | BOOLEAN | -resp-only | display tls response only |
| scan-mode | STRING | -scan-mode | tls connection mode to use (ctls, ztls, openssl, auto) (default "auto") |
| tls-chain | BOOLEAN | -tls-chain | display tls chain in json output |
| untrusted | BOOLEAN | -untrusted | display host with untrusted certificate |
| ip-version | STRING | -ip-version | ip version to use (4, 6) (default 4) |
| mismatched | BOOLEAN | -mismatched | display host with mismatched certificate |
| random-sni | BOOLEAN | -random-sni | use random sni when empty |
| all-ciphers | BOOLEAN | -all-ciphers | send all ciphers as accepted inputs (default true) |
| certificate | BOOLEAN | -certificate | include certificates in json output (PEM format) |
| cipher-enum | BOOLEAN | -cipher-enum | enumerate and display supported cipher |
| cipher-type | STRING | -cipher-type | ciphers types to enumerate. possible values: all/secure/insecure/weak (comma-separated) (default all) |
| concurrency | STRING | -concurrency | number of concurrent threads to process (default 300) |
| max-version | STRING | -max-version | maximum tls version to accept (ssl30,tls10,tls11,tls12,tls13) |
| min-version | STRING | -min-version | minimum tls version to accept (ssl30,tls10,tls11,tls12,tls13) |
| self-signed | BOOLEAN | -self-signed | display status of self-signed certificate |
| tls-version | BOOLEAN | -tls-version | display used tls version |
| verify-cert | BOOLEAN | -verify-cert | enable verification of server certificate |
| cipher-input | STRING | -cipher-input | ciphers to use with tls connection |
| client-hello | BOOLEAN | -client-hello | include client hello in json output (ztls mode only) |
| common-names | BOOLEAN | -cn | display subject common names |
| health-check | BOOLEAN | -health-check | run diagnostic check up |
| probe-status | BOOLEAN | -probe-status | display tls probe status |
| scan-all-ips | BOOLEAN | -scan-all-ips | scan all ips for a host (default false) |
| server-hello | BOOLEAN | -server-hello | include server hello in json output (ztls mode only) |
| version-enum | BOOLEAN | -version-enum | enumerate and display supported tls versions |
| pre-handshake | BOOLEAN | -pre-handshake | enable pre-handshake tls connection (early termination) using ztls |
| wildcard-cert | BOOLEAN | -wildcard-cert | display host with wildcard ssl certificate |
| openssl-binary | FILE | -openssl-binary | OpenSSL Binary Path |
| cipher-concurrency | STRING | -cipher-concurrency | cipher enum concurrency for each target (default 10) |
| subject-alternative-names | BOOLEAN | -san | display subject alternative names |
| subject-organization-name | BOOLEAN | -so | display subject organization name |
example
Run tlsx
# grab SANs and JARM from a host list as JSONLtlsx -list hosts.txt -san -jarm -json -silent -port 443example.com:443 [tls13] [CN=example.com] [SAN=example.com,www.example.com]api.example.com:443 [tls13] [CN=api.example.com]www.example.com:443 [tls12] [CN=www.example.com] [SAN=www.example.com,example.com]mail.example.com:443 [tls13] [CN=mail.example.com]staging.example.com:443 [tls12] [CN=*.example.com] [SAN=*.example.com,example.com]198.51.100.10:443 [tls13] [CN=example.com]203.0.113.25:443 [tls12] [CN=api.example.com]guidance
Choosing tlsx
Use tlsx when you need TLS and certificate data across a host list, including SAN mining or JARM clustering. For deep protocol-level audits, run sslscan or testssl alongside it.
sslscan
Deep per-host SSL/TLS protocol and cipher audit. Richer than tlsx, less suited to wide scopes.
httpx
General HTTP prober that also reports some TLS data. tlsx goes deeper on certificates and fingerprints.
subfinder
Passive subdomain discovery. tlsx complements it by extracting more names from certificate SANs.
faq
tlsx questions
related
More Recon tools
amass
Multi-source subdomain discovery; hand names to httpx.
amass-intel
OWASP Amass intel: map an organization's root domains and ranges.
assetfinder
Find domains and subdomains potentially related to a given domain.
bbot
Modular OSINT recon that chains modules from a seed target.
bevigil
CLI client for the BeVigil OSINT API, keyed by domain or app package.
cloud-enum
Multi-cloud public name enumeration for AWS, Azure, and GCP.
Run tlsx yourself
A host list feeds tlsx, which grabs certificate and TLS data from each one and writes the results, including SANs, as a queryable output.
Facts on this page come from the live Trickest tool library.