sslyze

No entries match these filters. Clear filters

1. docs update Oct 3, 2026 · issue 093

   SSLyze adds JSON export via --json_out CLI flag and SslyzeOutputAsJson Python API with from_file() parsing helper⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ TRY IT
   Export scan results to JSON during a CLI scan so a separate pipeline can ingest and process them.
   copy

   $ python -m sslyze www.google.com www.facebook.com --json_out=result.json

   Parse a previously saved JSON results file in Python to inspect certificate fingerprints and connectivity errors programmatically.
   python copy

   results_as_json = results_as_json_file.read_text()
   parsed_results = SslyzeOutputAsJson.model_validate_json(results_as_json)
   for server_scan_result in parsed_results.server_scan_results:
       print(server_scan_result.server_location.hostname)

   • Adds --json_out CLI flag to export scan results to a JSON file (e.g.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠ --json_out=result.json) for downstream processing.
   • Adds SslyzeOutputAsJson.from_file() method to parse a JSON results file into a typed Python object with annotations on all fields.
   • Adds SslyzeOutputAsJson.model_dump_json() API path for programmatically serializing scan results to JSON from Python without the CLI.
   • Publishes a JSON output schema at ./json_output_schema.json in the code repository for validating or documenting the scan result format.

   4 details in Everything

2. 6.3.0 Dec 30, 2025 · release notes

   sslyze 6.3.0 adds Python 3.14 support and expands elliptic curve scanning to include Brainpool curves.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 6.3.0 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 6.3.0

   • Supports Python 3.14 runtime.
   • Extends EllipticCurvesScanPlugin (the --elliptic_curves scan) to detect Brainpool curve support in addition to previously covered curves.

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Python 3.9 is no longer supported; running sslyze on Python 3.9 will break after upgrading.
3. 6.2.0 Aug 3, 2025 · release notes

   sslyze 6.2.0 adds custom TLS compliance profiles and SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address.-less certificate chain retrieval.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 6.2.0 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 6.2.0

   └──▷ TRY IT
   Audit a server against your own TLS policy (e.g. org-wide cipher/protocol baseline) instead of a Mozilla preset.
   copy

   $ sslyze --custom_tls_config <path_to_config> <target>

   Retrieve the certificate chain presented by a server that doesn't support or require SNI — useful for IP-only TLS endpoints.
   copy

   $ sslyze --certinfo <target>

   • Supports specifying a custom TLS configuration/profile to validate servers against, as an alternative to the built-in Mozilla old/intermediate/modern profiles.
   • Supports retrieving a server's certificate chain when no Server Name Indication (SNI) is supplied via --certinfo.

   2 details in Everything

4. 6.1.0 Jan 4, 2025 · release notes

   sslyze 6.1.0 adds Extended Master Secret detection, custom HTTP agent/SMTPSMTPThe application-layer protocol used to send email between servers and from clients to servers; cyber tools use it to relay alerts, phishing simulations, or exfiltrated data over standard mail infrastructure. EHLO support, and configurable renegotiation attempts.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 6.1.0 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 6.1.0

   • New check: detects whether the Extended Master Secret TLS extension is supported by the target server.
   • Enables supplying a custom HTTP agent via the Python API for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. scanning.
   • Enables supplying a custom SMTP EHLO hostname via the Python API for STARTTLSSTARTTLSA protocol command that upgrades a plaintext connection to an encrypted TLS session without changing ports, used in SMTP, IMAP, and LDAP so tools can negotiate encryption opportunistically on standard service ports. scanning.
   • Enables configuring the number of client renegotiation test attempts via the Python API.
   • Adds experimental support for aarch64-based Linux.

   +1 more show less

   • Adds support for Python 3.13.

   6 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Support for Python 3.8 has been removed; setups running sslyze under Python 3.8 will break.
   • !Support for Intel-based Macs has been removed; sslyze will no longer run on that platform.
5. 5.2.0 Sep 24, 2023 · release notes

   sslyze 5.2.0 adds pydantic 2.x support and updates Windows build to Python 3.11

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.2.0 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 5.2.0

   └──▷ BREAKING ON UPGRADE

   • !Python 3.7 is no longer supported; this is the last release with Python 3.7 compatibility.
   • !pydantic 1.x is no longer supported; this is the last release with pydantic 1.x compatibility.
6. 5.1.3 Apr 1, 2023 · release notes

   SSlyze 5.1.3 adds native Apple Silicon support and drops Windows 7

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.1.3 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 5.1.3

   • Removes support for Windows 7

   1 detail in Everything

7. 5.1.0 Jan 17, 2023 · release notes

   sslyze 5.1.0 adds Brainpool curve support, IP SAN validation, and Python 3.11 compatibility.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.1.0 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 5.1.0

   └──▷ TRY IT
   Scan a server for support of Brainpool elliptic curves.
   copy

   $ sslyze --regular example.com --elliptic_curves

   • Adds --elliptic_curves detection of Brainpool curves
   • Adds certificate validation for Subject Alternative Names containing IP addresses
   • Adds Python 3.11 platform support

   3 details in Everything

8. 5.0.6 Oct 15, 2022 · release notes

   sslyze 5.0.6 adds support for more TLS stacks in elliptic curve scanning and documents JSON export via Python API

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.0.6 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 5.0.6

9. 5.0.3 Mar 13, 2022 · release notes

   sslyze 5.0.3 adds --mozilla_config=disable to skip Mozilla profile checks

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch 5.0.3 https://github.com/nabla-c0d3/sslyze.git
   # already have the repo? check out this version:
   $ git checkout 5.0.3

   • Disables server scan result checking against Mozilla configurations via --mozilla_config=disable

   1 detail in Everything

10. 5.0.0 Nov 26, 2021 · release notes

    sslyze 5.0 adds Mozilla TLS config checking, CI/CD support, typed Python API for JSON parsing, and simplified session resumption testing.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 5.0.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 5.0.0

    └──▷ USE IT
    Parse a previously run SSLyze JSON result file using the new typed Python API.
    python copy

    parsed_json_result = SslyzeOutputAsJson.parse_file("result.json")

    Configure session resumption testing to attempt 20 resumptions instead of the default.
    shell copy

    python -m sslyze --resum --resum_attempts=20 www.google.com

    • --mozilla-config={old, intermediate, modern} flag to check servers against Mozilla's recommended configurations
    • Ability to run as a CI/CD step via the README instructions
    • Fully-typed Python API for parsing JSON output using SslyzeOutputAsJson.parse_file
    • --resum_attempts option to configure session resumption attempts (default 5)
    • Auto-generated JSON schema available at ./json_output_schema.json

    5 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --regular flag has been removed and replaced by --mozilla-config
    • !The Python API for starting scans and processing results has changed significantly
    • !public_key_pins_header and public_key_pins_report_only_header fields removed from HttpHeadersScanResult
    • !The --resum_rate command, ScanCommand.SESSION_RESUMPTION_RATE, and SessionResumptionRateScanResult class have been removed in favor of --resum_attempts and SessionResumptionSupportExtraArguments
11. 3.1.0 Nov 11, 2020 · release notes

    sslyze 3.1.0 adds --elliptic_curves flag to scan for supported and rejected elliptic curves

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.1.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 3.1.0

    └──▷ TRY IT
    Identify which elliptic curves a target server accepts or rejects to assess key exchange security posture.
    copy

    $ python -m sslyze --elliptic_curves www.cloudflare.com

12. 3.0.7 Jun 13, 2020 · release notes

    sslyze 3.0.7 adds default --regular behavior when no scan options are supplied

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.7 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 3.0.7

    └──▷ TRY IT
    Quickly run a standard set of SSL/TLS tests on a target without typing extra flags.
    copy

    $ python -m sslyze google.com

    • python -m sslyze google.com now runs --regular by default instead of requiring explicit scan options

    1 detail in Everything

13. 3.0.1 Apr 3, 2020 · release notes

    Adds a pre-built Windows executable for easier local use.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 3.0.1 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 3.0.1

    • Provides a sslyze-3.0.1-exe.zip package containing a ready-to-run Windows binary.

    1 detail in Everything

14. 2.0.2 Dec 3, 2018 · release notes

    Adds ServerConnectivityTester exceptions and OpenJDK trust store validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.2 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 2.0.2

    • Added more precise exceptions when the ServerConnectivityTester fails to connect to the server.
    • Added the OpenJDK trust store when validating the server's certificate.

    2 details in Everything

15. 2.0.0 Sep 23, 2018 · release notes

    sslyze 2.0 adds TLS 1.3 support with --tls_1_3 and --early_data flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 2.0.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 2.0.0

    └──▷ TRY IT
    Scan a server to verify official TLS 1.3 support using the new flag
    copy

    $ python -m sslyze --tls_1_3 www.cloudflare.com

    Test a server for TLS 1.3 early data (0-RTT) support using the new beta flag
    copy

    $ python -m sslyze --early_data www.cloudflare.com

    • Added --tls_1_3 flag to scan for official TLS 1.3 support (RFC 8446)
    • Added --early_data flag and EarlyDataScanCommand for beta TLS 1.3 early data (0-RTT) testing
    • Dropped support for Python 2 and older Python 3 versions; now requires Python 3.6 or 3.7

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The tool no longer runs on Python 2 or Python versions older than 3.6
16. 1.4.0 Mar 11, 2018 · release notes

    sslyze 1.4.0 adds --slow_connection flag and Python API error specialization

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.4.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.4.0

    • Replaces --timeout and --nb_retries CLI options with a new --slow_connection argument to handle slow servers or limited concurrency.
    • Python API now returns specialized subclasses of ServerConnectivityError for specific connectivity testing failures.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --timeout and --nb_retries CLI options are removed; use --slow_connection instead.
17. 1.3.4 Feb 2, 2018 · release notes

    sslyze 1.3.4 adds CLI/TrustStoresRepository trust store updates and Expect CT support in -http_headers.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3.4 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.3.4

    └──▷ TRY IT
    Update SSLyze's local trust store definitions via the command line.
    copy

    $ sslyze --update_trust_stores

    Programmatically refresh trust stores within a Python script using the API.
    python copy

    from sslyze import TrustStoresRepository
    TrustStoresRepository.update_default()

    • Adds --update_trust_stores CLI flag to update the local trust stores repository.
    • Adds TrustStoresRepository.update_default() method to the Python API for trust store updates.
    • Adds detection for the Expect CT HTTP header when using the -http_headers option.

    3 details in Everything

18. 1.3.2 Dec 24, 2017 · release notes

    sslyze 1.3.2 improves TLS 1.3 scanning performance and adds IANA cipher names.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3.2 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.3.2

    • Improved speed when testing for TLS 1.3 cipher suites using --tlsv1_3.

    1 detail in Everything

19. 1.3.0 Dec 18, 2017 · release notes

    SSLyze v1.3.0 adds ROBOT vulnerability scanning and OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. Must-Staple/CT info to --certinfo

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.3.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.3.0

    └──▷ USE IT
    Quickly check if a public server is vulnerable to the ROBOT attack via CLI.
    shell copy

    sslyze --robot www.google.com

    • --robot flag added as a new capability for scanning servers against the ROBOT vulnerability
    • RobotScanCommand class added to the Python API for programmatic ROBOT scanning
    • --certinfo command now returns OCSPMustStaple and CertificateTransparency extension data in JSON/XML output

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Minimum supported Python version is raised to 3.4; versions before 3.4 will no longer work.
20. 1.2.0 Nov 25, 2017 · release notes

    sslyze 1.2.0 adds TLS 1.3 (draft 18) scanning and ChaCha20 cipher support via CLI

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.2.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.2.0

    └──▷ USE IT
    Scan a server specifically for TLS 1.3 (draft 18) compatibility using the new CLI flag.
    shell copy

    python -m sslyze --tlsv1_3 tls13.crypto.mozilla.org

    • python -m sslyze --tlsv1_3 enables scanning for TLS 1.3 (draft 18) support.
    • Adds detection and reporting for new-style ChaCha20 cipher suites.

    2 details in Everything

21. 1.1.3 Sep 6, 2017 · release notes

    Adds a standalone Windows executable for SSLyze without Python installation

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.3 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.1.3

    • Drops the need to install Python on Windows by providing a pre-compiled executable
    • Adds Subject and Issuer fields to the XML output

    2 details in Everything

22. 1.1.0 Apr 16, 2017 · release notes

    sslyze 1.1.0 adds client auth cipher scanning and SCT via OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. stapling; drops --print_full_certificate.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.1.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.1.0

    • CertificateInfoScanCommand now displays certificate transparency SCTs when available via OCSP Stapling
    • Added support for scanning cipher suites on servers that require client authentication (mutual TLSmutual TLSMutual TLS, an encrypted connection where both client and server present certificates to prove their identity. It helps services verify who they are communicating with.)

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --print_full_certificate option is no longer available; XML/JSON consumers must parse the PEM-formatted certificate in the output using their own libraries.
23. 1.0.0 Feb 13, 2017 · release notes

    SSLyze 1.0.0 adds a stable Python API and improves certinfo trust store usage.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 1.0.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 1.0.0

    • Releases a fully documented and stable Python API for SSLyze integration.

    1 detail in Everything

    └──▷ BREAKING ON UPGRADE

    • !The --certinfo_basic command is renamed to --certinfo.
24. 0.14.1 Oct 16, 2016 · release notes

    SSLyze 0.14.1 changes entry point to python -m sslyze and adds User-Agent header

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.14.1 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.14.1

    └──▷ TRY IT
    Run SSLyze using the new standard module invocation.
    copy

    $ python -m sslyze --server_info server.example.com:443

    • The CLI entry point is now ./sslyze/__main__.py, invoked via python -m sslyze instead of ./sslyze_cli.py.
    • HTTP requests now include a User-Agent header containing SSLyze.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Running ./sslyze_cli.py will fail as the script has been moved to ./sslyze/__main__.py; use python -m sslyze instead.
25. 0.14.0 Sep 1, 2016 · release notes

    sslyze 0.14.0 adds verified cert chain output and renames --hsts to --http_headers for HPKP data.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.14.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.14.0

    └──▷ USE IT
    Scan a server for HTTP headers (including legacy HPKP) using the new flag name.
    shell copy

    sslyze --http_headers ssl.example.com

    Retrieve the full verified certificate chain for a trusted server using the enhanced basic certinfo command.
    shell copy

    sslyze --certinfo_basic ssl.example.com

    • --certinfo_basic now returns the server's verified certificate chain (leaf to Mozilla root) when the server's certificate is trusted.
    • Renamed --hsts flag to --http_headers; this flag now returns HTTP Public Key Pinning (HPKP) information including HPKP header values and pins for each certificate in the verified chain.

    2 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The CLI flag --hsts is renamed to --http_headers. Using --hsts will result in an error or unexpected behavior.
26. 0.13.6 Jun 4, 2016 · release notes

    AOSP trust store now used by default in --certinfo for Android certificate validation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.13.6 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.13.6

    └──▷ TRY IT
    Validate a server's certificates against the AOSP trust store.
    copy

    $ sslyze --certinfo=scan_commands server.example.com:443

    • Adds the Android Open Source Project's trust store when using --certinfo

    1 detail in Everything

27. 0.13.4 Feb 14, 2016 · release notes

    New --json_out CLI flag writes scan results to a file in JSON format

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.13.4 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.13.4

    └──▷ USE IT
    Write the full SSL/TLS scan output to a local file for downstream parsing or logging.
    shell copy

    sslyze --json_out /tmp/scan_results.json tls://example.com:443

    • Adds --json_out command for writing results to a file as JSON.

    1 detail in Everything

28. 0.13.3 Feb 2, 2016 · release notes

    SSLyze 0.13.3 adds Python module support, --fallback and --openssl_ccs CLI commands

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.13.3 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.13.3

    • Turns SSLyze into a Python module (import sslyze) available on PyPi to allow scans to be run directly from Python scripts
    • Adds the --openssl_ccs command line flag to check for the OpenSSL CCS Injection vulnerability
    • Adds the --fallback command line flag to check support for the TLS_FALLBACK_SCSV cipher suite and prevent downgrade attacks
    • Renamed the --certinfo=basic and --certinfo=full commands to --certinfo_basic and --certinfo_full respectively

    4 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The command line tool has been renamed from the default executable to _sslyze_cli.py_ to avoid conflicts with the new sslyze module
    • !The --certinfo=basic and --certinfo=full flags are now --certinfo_basic and --certinfo_full
    • !The --chrome_sha1 command has been removed
29. 0.12.0 Sep 24, 2015 · release notes

    sslyze 0.12.0 adds Google trust store, client cert chain support, and console XML output

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.12.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.12.0

    └──▷ USE IT
    Stream sslyze XML results to stdout for piping into other tools in a CI pipeline.
    shell copy

    sslyze --regular example.com --xml_out -

    • --xml_out - enables printing XML output directly to the console instead of a file
    • Support for supplying a full (client) certificate chain when authenticating with client certificates
    • Added Google trust store for certificate validation

    3 details in Everything

30. 0.11.0 Apr 12, 2015 · release notes

    sslyze 0.11.0 adds Postgres StartTLS support, --ca_file option, and quiet XML mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.11.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.11.0

    • --ca_file allows specifying a local trust store for certificate validation.
    • --quiet hides text output when using --xml_out.
    • Added support for Postgres StartTLS.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The XML output format changed in a way that breaks parsing by existing tools; an XML Schema Definition is now provided to align consumers.
31. 0.5.0 Sep 23, 2014 · release notes

    Adds XML output (--xml_out), target file input (--targets_in), CRIME testing, and hostname/EV cert validation in sslyze 0.5.0

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.5.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.5.0

    └──▷ USE IT
    Export scan results to a structured XML file for downstream parsing or SIEMSIEMSecurity information and event management, collecting logs from many systems and correlating events to find suspicious activity. Analysts use it to investigate alerts and incidents. ingestion.
    shell copy

    sslyze --regular example.com --xml_out output.xml

    Scan a batch of servers defined in a file instead of passing them as individual arguments.
    shell copy

    sslyze --targets_in targets.txt

    Check if the target server is vulnerable to the CRIME compression attack.
    shell copy

    sslyze --compression example.com

    • Adds --xml_out flag to emit scan results in XML format with full certificate parsing
    • Adds --targets_in flag to specify a text file containing the list of servers to scan
    • Enables OS X Mountain Lion support
    • Adds compression / CRIME testing capability

    4 details in Everything

32. 0.6.0 Sep 23, 2014 · release notes

    SSlyze 0.6.0 adds SNISNIA TLS extension that lets a client declare which hostname it is connecting to during the handshake, allowing one server to host multiple certificates on a single IP address. via -sni, partial results for missing client certs, and preliminary IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.6.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.6.0

    • Adds -sni flag to specify Server Name Indication hostname during handshake
    • Returns partial scan results instead of failing when client authentication is required but no certificate is provided
    • Adds preliminary IPv6 address support for target connections

    3 details in Everything

33. 0.7.0 Sep 23, 2014 · release notes

    Adds StartTLS protocol support and OCSPOCSPA protocol for checking whether a TLS certificate has been revoked, defined in RFC 6960, letting clients query a CA's responder in real time instead of downloading full CRL lists. Stapling checks via CLI flags

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.7.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.7.0

    └──▷ TRY IT
    Perform an StartTLS scan against a legacy IMAP server
    copy

    $ sslyze --starttls=imap imap.example.com:993

    • Adds --starttls flag to scan FTP, POP, IMAP, LDAPLDAPA protocol for querying and modifying directory services, standardized under RFC 4511, commonly used to look up users, groups, and attributes in corporate identity stores like Active Directory., and auto protocols, removing the requirement for plain SSL/TLS connections.
    • Adds --certinfo option to retrieve and display OCSP Stapling status for tested endpoints.
    • Replaces the Python OpenSSL wrapper with a static C extension linking against the latest OpenSSL, making SSL 2.0/1.1/1.2 checks available on all supported platforms.

    3 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !Python 2.6 is no longer supported; upgrading requires a newer Python version.
34. 0.8.0 Sep 23, 2014 · release notes

    sslyze 0.8.0 adds StartTLS RDPRDPA Microsoft protocol that lets a user view and control a remote Windows desktop over a network, giving cyber tools a standard channel to audit, attack-simulate, or monitor Windows systems remotely. support, extended trust stores, and retry control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.8.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.8.0

    └──▷ TRY IT
    Scan an RDP server using StartTLS to validate its certificate against multiple OS-specific trust stores.
    copy

    $ sslyze --starttls=rdp my-rdp-server.com

    Limit retry attempts to reduce scan duration or avoid timeouts on unstable servers.
    copy

    $ sslyze my-server.com --nb_retries 3

    • Adds --starttls=rdp flag to enable StartTLS RDP scanning
    • Extends certificate chain validation to Apple, Microsoft, and Java trust stores alongside Mozilla's
    • Adds --nb_retries flag to control the number of exponential backoff retry attempts for failed connections

    3 details in Everything

35. 0.9.0 Sep 23, 2014 · release notes

    sslyze 0.9.0 adds experimental Heartbleed detection, Basic Auth for HTTPSHTTPSHTTP carried over an encrypted TLS connection. It protects traffic in transit and lets a browser verify the server's certificate. tunneling, and connection concurrency capping

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.9.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.9.0

    └──▷ TRY IT
    Scan for Heartbleed vulnerability on a specific host
    copy

    $ sslyze --heartbleed <target>

    Tunnel a scan through an HTTPS proxy requiring Basic Authentication
    copy

    $ sslyze --https_tunnel=http://user:password@proxy.example.com:8080 <target>

    • Adds --heartbleed flag to enable experimental Heartbleed vulnerability detection, also included in regular scans
    • Adds support for Basic Authentication when using --https_tunnel by parsing credentials from the proxy URL
    • Introduces a hard cap on concurrent connections (approx. 30 per server) via internal logic to prevent target overload

    3 details in Everything

36. 0.10.0 Sep 21, 2014 · release notes

    sslyze 0.10.0 adds Chrome SHA1 cert check plugin and displays DH param sizes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch 0.10.0 https://github.com/nabla-c0d3/sslyze.git
    # already have the repo? check out this version:
    $ git checkout 0.10.0

    └──▷ USE IT
    Check if a server is affected by Chrome's deprecation of SHA1-signed certificates
    shell copy

    sslyze --chrome_sha1 server.example.com:443

    • Adds --chrome_sha1 flag to use the new plugin checking if a server is affected by Chrome's deprecation of SHA1-signed certificates
    • PluginOpenSSLCipherSuites now displays the size of the handshake's Diffie-Hellmann parameters
    • PluginCertInfo now displays the server's full certificate chain instead of its leaf certificate only, in both the console and XML results

    3 details in Everything