testssl.sh
testssl · TLS audit · TLS check · encryption test
A free script that audits a server’s TLS configuration: accepted protocols, cipher suites, certificate and security headers.
In practice
testssl.sh shows in plain sight, colour-coded output included, what a server still accepts: obsolete versions (SSL, TLS 1.0 or 1.1), weak suites, expired or self-signed certificates, missing HSTS, dangerous renegotiation. It is one of the tools an auditor cites to justify every encryption finding; the same checks underpin the A+ to F grades of online services. A well-configured server only accepts recent TLS versions with strong suites, whatever the tool asking.
Fictional case: an online shop’s audit shows TLS 1.0 still accepted for an old payment integration, and the staging subdomain’s certificate expired eight months ago. One is switched off, the other renewed: two classic findings, fixed within the afternoon.
