nabla-c0d3/sslyze

★ 3,756PythonAudience · ops devopsComplexity · 2/5LicenseSetup · easy

Mindmap

mindmap
  root((SSLyze))
    What it does
      TLS scanner
      Security audit
      Vulnerability check
    Checks
      Protocol versions
      Cipher suites
      Certificate config
      Known CVEs
    Output
      JSON results
      CI exit codes
      Mozilla profiles
    Protocols
      HTTPS
      SMTP IMAP
      LDAP Postgres
    Install
      pip install
      Docker image
      Windows binary

mindmap root((SSLyze)) What it does TLS scanner Security audit Vulnerability check Checks Protocol versions Cipher suites Certificate config Known CVEs Output JSON results CI exit codes Mozilla profiles Protocols HTTPS SMTP IMAP LDAP Postgres Install pip install Docker image Windows binary

Click or tap to explore — scroll the page freely

Things people build with this

USE CASE 1

Scan a public website to check whether its HTTPS encryption is correctly configured and free from known vulnerabilities

USE CASE 2

Add SSLyze to a CI/CD pipeline so that a deployment automatically fails if it introduces a weaker TLS setup

USE CASE 3

Scan non-web servers like mail, LDAP, or database servers to audit their encryption configurations

USE CASE 4

Embed SSLyze as a Python library into a security dashboard or automated compliance checker

Tech stack

PythonDocker

Getting it running

Difficulty · easy Time to first run · 5min

Licensed under AGPL, you can use and modify it freely, but if you distribute it or run it as a network service you must release your source code under the same license.

In plain English

SSLyze is a Python tool for scanning the SSL/TLS configuration of servers and checking whether those configurations meet security standards. SSL and TLS are the protocols that encrypt traffic between browsers and websites, or between servers. A misconfigured server can use outdated encryption methods or be vulnerable to known attacks, and SSLyze is designed to detect those issues. When you run SSLyze against a server, it connects to that server and checks what encryption settings it supports: which versions of the protocol it accepts, which cipher suites it offers, how its certificate is configured, and whether it is vulnerable to documented attacks like Heartbleed or ROBOT. The results can be saved to a JSON file for further processing. The tool also supports non-web servers including mail servers using SMTP and IMAP, directory servers using LDAP, and database servers using Postgres, among others. One practical use case highlighted in the README is running SSLyze as a step in a continuous integration pipeline. By default, SSLyze checks scan results against Mozilla's recommended TLS configuration and exits with an error code if the server does not comply. You can choose between Mozilla's old, intermediate, or modern configuration profiles, or supply your own custom configuration as a JSON file. This makes it straightforward to automatically flag a deployment that introduces a weaker TLS setup. SSLyze is also available as a Python library with a documented API, so it can be embedded into other applications or run from serverless functions. It installs via pip and also comes as a Docker image and a precompiled Windows executable for users who do not have a Python environment set up. The project is licensed under the GNU Affero General Public License (AGPL).

Copy-paste prompts

Prompt 1

Show me the SSLyze command to scan example.com and check it against Mozilla's intermediate TLS profile, then save results to a JSON file.

Prompt 2

Help me add an SSLyze scan step to a GitHub Actions workflow that fails the build if the deployed server doesn't meet Mozilla's recommended TLS config.

Prompt 3

I want to scan an SMTP mail server with SSLyze to check its STARTTLS encryption, show me the correct command and what the output means.

Prompt 4

Show me how to use SSLyze as a Python library to scan a server programmatically and extract a list of supported cipher suites from the results.

Open on GitHub → Explain another repo

← nabla-c0d3 on gitmyhub — every repo by this author, as a profile.

Verify against the repo before relying on details.