---
title: "testssl.sh"
description: "A free script that audits a server’s TLS configuration: accepted protocols, cipher suites, certificate and security headers. Examples and defences."
url: https://krakenshield.eu/knowledge/glossary/testssl-sh/
lang: en
publisher: KrakenShield (KRAKEN HOLDING SAS)
overview: https://krakenshield.eu/llms.txt
---
# testssl.sh
> A free script that audits a server’s TLS configuration: accepted protocols, cipher suites, certificate and security headers. Examples and defences.

Pentest and offensive

testssl · TLS audit · TLS check · encryption test

A free script that audits a server’s TLS configuration: accepted protocols, cipher suites, certificate and security headers.

## In practice

testssl.sh shows in plain sight, colour-coded output included, what a server still accepts: obsolete versions (SSL, TLS 1.0 or 1.1), weak suites, expired or self-signed certificates, missing HSTS, dangerous renegotiation. It is one of the tools an auditor cites to justify every encryption finding; the same checks underpin the A+ to F grades of online services. A well-configured server only accepts recent TLS versions with strong suites, whatever the tool asking.

> **Example**
> Example
> 
> Fictional case: an online shop’s audit shows TLS 1.0 still accepted for an old payment integration, and the staging subdomain’s certificate expired eight months ago. One is switched off, the other renewed: two classic findings, fixed within the afternoon.

## Sources

- [testssl.sh, official website](https://testssl.sh/)
- [testssl.sh (source code)](https://github.com/drwetter/testssl.sh)