sslscan

sslscan connects to a server and reports exactly what its TLS configuration supports: which protocol versions answer (including the ones that shouldn’t, like SSLv2/SSLv3), which cipher suites it’ll negotiate, key-exchange group support, and the certificate itself. It’s narrower than a full vulnerability scanner by design — one job, done fast — which makes it the tool you reach for the moment a target has an HTTPS port and you want to know if the TLS side is sane before going anywhere near the application.

It lives at Security → Vulnerability Analysis → sslscan.

The help it prints

Show the full output64 lines
Usage: sslscan [Options] [host:port | host]

Options:
  --targets=<file>     A file containing a list of hosts to check.
                         Hosts can be supplied with ports (host:port)

  --sni-name=<name>     Hostname for SNI

  --ipv4 or -4          Only use IPv4
  --ipv6 or -6          Only use IPv6

  --show-certificate    Show full certificate information
  --show-certificates   Show full certificate information for all certificates in the chain
  --show-client-cas     Show trusted CAs for TLS client authentication
  --no-check-certificate
                        Don't warn about weak certificate algorithm or keys
  --pk=<file>            A file containing the private key or PKCS#12 file
  --pkpass=<password>    The password for the private key or PKCS#12 file
  --certs=<file>          A file containing PEM/ASN1 formatted client certificates

  --starttls-ftp        STARTTLS setup for FTP
  --starttls-imap       STARTTLS setup for IMAP
  --starttls-irc        STARTTLS setup for IRC
  --starttls-ldap       STARTTLS setup for LDAP
  --starttls-mysql      STARTTLS setup for MySQL
  --starttls-pop3       STARTTLS setup for POP3
  --starttls-psql       STARTTLS setup for PostgreSQL
  --starttls-smtp       STARTTLS setup for SMTP
  --starttls-xmpp       STARTTLS setup for XMPP
  --xmpp-server         Perform a server-to-server XMPP connection
  --rdp                 Send RDP preamble before starting scan

  --no-ciphersuites     Do not scan for supported ciphersuites
  --show-cipher-ids     Show the hexadecimal cipher IDs
  --show-times          Show handshake times in milliseconds
  --iana-names          Use IANA/RFC cipher names rather than OpenSSL ones

  --no-compression      Do not check for TLS compression (CRIME)
  --no-fallback         Do not check for TLS Fallback SCSV
  --no-groups           Do not enumerate key exchange groups
  --no-heartbleed       Do not check for OpenSSL Heartbleed (CVE-2014-0160)
  --no-renegotiation    Do not check for TLS renegotiation
  --show-sigs           Enumerate signature algorithms
  --ocsp                Request OCSP response from server

  --ssl2                Only check if SSLv2 is enabled
  --ssl3                Only check if SSLv3 is enabled
  --tls10               Only check TLS 1.0 ciphers
  --tls11               Only check TLS 1.1 ciphers
  --tls12               Only check TLS 1.2 ciphers
  --tls13               Only check TLS 1.3 ciphers
  --tlsall              Only check TLS ciphers (1.0, 1.1, 1.2 and 1.3)

  --bugs                Enable SSL implementation bug workarounds
  --sleep=<msec>         Pause between connections
  --timeout=<sec>        Set socket timeout (default 3s)
  --connect-timeout=<sec>
                        Set initial connection timeout (default 75s)

  --xml=<file>            Output results as an XML document
  --verbose             Display verbose output
  --no-colour            Disable coloured output
  --version              Display the program version
  --help                 Display this help text

Examples

# The default pass — protocols, ciphers, and certificate
sslscan example.com

# Non-standard port
sslscan example.com:8443

# Only care whether TLS 1.0/1.1 are still enabled
sslscan --tls10 --tls11 example.com

# STARTTLS on mail services instead of a straight TLS handshake
sslscan --starttls-smtp mail.example.com:25

# Full certificate chain plus signature-algorithm enumeration
sslscan --show-certificates --show-sigs example.com

# Batch a target list and keep the output machine-readable
sslscan --targets=hosts.txt --xml=results.xml

Weak protocols (SSLv2/SSLv3, TLS 1.0/1.1), missing forward secrecy, and an expired or self-signed certificate are the three things worth scanning for first — sslscan surfaces all three in one pass, before you move on to nikto or nuclei for the rest of the server.