Table of Contents
Overview
SSLyze is a fast and powerful SSL/TLS scanning tool that can analyze the SSL/TLS configuration of a server by testing multiple aspects of its SSL/TLS deployment.
Key Features
Certificate validation
Cipher suite analysis
Protocol support testing
Vulnerability scanning
Performance testing
Multiple output formats
Concurrent scanning
Detailed reporting
Installation
Using pip
# Install sslyze
pip install --upgrade sslyze
# Install with all features
pip install --upgrade 'sslyze[json]'
Using Docker
# Pull Docker image
docker pull nablac0d3/sslyze
# Run with Docker
docker run --rm nablac0d3/sslyze --regular example.com:443
Basic Usage
Simple Scans
# Basic scan
sslyze example.com
# Scan specific port
sslyze example.com:443
# Multiple targets
sslyze example1.com example2.com
# Scan with JSON output
sslyze --json_out results.json example.com
Common Options
# Regular scan
sslyze --regular example.com
# Fast scan
sslyze --fast example.com
# Show certificate info
sslyze --certinfo example.com
# Show supported ciphers
sslyze --sslv2 --sslv3 --tlsv1 --tlsv1_1 --tlsv1_2 --tlsv1_3 example.com
Scan Types
Protocol Support
# Test all protocols
sslyze --robot --heartbleed --fallback --compression example.com
# Test specific protocols
sslyze --tlsv1_2 --tlsv1_3 example.com
# Test early TLS
sslyze --sslv2 --sslv3 --tlsv1 example.com
Cipher Suites
# Test cipher suites
sslyze --regular example.com
# Test specific cipher
sslyze --tlsv1_2 --openssl_cipher_string= "AES256-SHA" example.com
# Show rejected ciphers
sslyze --rejected_ciphers example.com
Certificate Analysis
# Full certificate info
sslyze --certinfo_full example.com
# Basic certificate info
sslyze --certinfo example.com
# Trust store validation
sslyze --certinfo --mozilla_trust_store example.com
Advanced Options
Connection Settings
# Custom timeout
sslyze --timeout 5 example.com
# Specify client certificate
sslyze --cert client.pem --key client.key example.com
# HTTP CONNECT proxy
sslyze --https_proxy proxy.example.com:8080 example.com
# Concurrent scanning
sslyze --concurrent 10 example.com
# Network timeout
sslyze --network_timeout 5 example.com
# Start TLS
sslyze --starttls=smtp smtp.example.com:25
Custom Tests
# Custom cipher string
sslyze --openssl_cipher_string= "HIGH:!aNULL" example.com
# Custom trust store
sslyze --custom_trust_store /path/to/store example.com
# Client authentication
sslyze --client_auth_credentials cert.pem key.pem example.com
JSON Output
# Basic JSON output
sslyze --json_out results.json example.com
# Pretty JSON output
sslyze --json_out results.json --json_pretty example.com
# Multiple targets
sslyze --json_out results.json example1.com example2.com
XML Output
# XML output
sslyze --xml_out results.xml example.com
# Detailed XML
sslyze --xml_out results.xml --regular example.com
Console Output
# Quiet mode
sslyze --quiet example.com
# Verbose mode
sslyze --verbose example.com
# Very verbose mode
sslyze --very_verbose example.com
Security Analysis
Vulnerability Scanning
# Check for known vulnerabilities
sslyze --robot --heartbleed --fallback example.com
# Full security scan
sslyze --regular --certinfo_full --http_headers example.com
# Check specific vulnerabilities
sslyze --robot --compression --heartbleed example.com
Compliance Testing
# PCI compliance
sslyze --regular --tlsv1_2 --tlsv1_3 example.com
# HIPAA compliance
sslyze --regular --certinfo_full --http_headers example.com
# NIST compliance
sslyze --regular --tlsv1_2 --tlsv1_3 --certinfo_full example.com
Best Practices
Scanning Guidelines
# Comprehensive scan
sslyze --regular \
--certinfo_full \
--http_headers \
--robot \
--heartbleed \
example.com
# Performance scan
sslyze --fast \
--concurrent 10 \
--network_timeout 5 \
example.com
Result Analysis
# Save detailed results
sslyze --regular \
--json_out detailed_scan.json \
--json_pretty \
example.com
# Generate report
sslyze --regular \
--xml_out report.xml \
--quiet \
example.com
Quick Reference
Essential Commands
# Basic scan
sslyze example.com
# Regular scan
sslyze --regular example.com
# Full scan
sslyze --regular --certinfo_full example.com
# Multiple targets
sslyze example1.com example2.com
Common Options
--regular # Regular scan
--certinfo # Certificate info
--json_out # JSON output
--xml_out # XML output
--heartbleed # Heartbleed test
--robot # ROBOT test
--compression # Compression test
Example Scripts
Basic Security Audit
#!/bin/bash
# Basic security audit script
TARGET = "example.com"
OUTPUT_DIR = "sslyze_results"
DATE = $( date +%Y%m%d_%H%M%S )
mkdir -p " $OUTPUT_DIR "
sslyze --regular \
--certinfo_full \
--heartbleed \
--robot \
--json_out " $OUTPUT_DIR /scan_ $DATE .json" \
--json_pretty \
" $TARGET "
Multiple Domain Scan
#!/bin/bash
# Scan multiple domains
DOMAINS = (
"example1.com"
"example2.com"
"example3.com"
)
OUTPUT_DIR = "sslyze_scans"
mkdir -p " $OUTPUT_DIR "
for domain in "${ DOMAINS [ @ ]}" ; do
echo "Scanning $domain ..."
sslyze --regular \
--json_out " $OUTPUT_DIR /${ domain }_scan.json" \
" $domain "
done
Compliance Check
#!/bin/bash
# Compliance checking script
TARGET = "example.com"
OUTPUT_DIR = "compliance_results"
mkdir -p " $OUTPUT_DIR "
# Run comprehensive compliance scan
sslyze --regular \
--certinfo_full \
--http_headers \
--robot \
--heartbleed \
--compression \
--json_out " $OUTPUT_DIR /compliance_scan.json" \
--json_pretty \
" $TARGET "
Remember:
Regular scanning schedule
Document findings
Update tool regularly
Monitor scan duration
Handle results securely
Follow security policies
For detailed information, consult the SSLyze documentation (sslyze --help
).