.TH SSLSCAN 1 "March 19, 2020"
.SH NAME
sslscan \- Fast SSL/TLS scanner
.SH SYNOPSIS
.B sslscan
.RI [ options ] " [host:port | host]"
.SH DESCRIPTION
.PP
\fBsslscan\fP queries SSL/TLS services (such as HTTPS) and reports the protocol versions, cipher suites, key exchanges, signature algorithms, and certificates in use.  This helps the user understand which parameters are weak from a security standpoint.

Terminal output is thus colour-coded as follows:

Red Background  NULL cipher (no encryption)
.br
Red             Broken cipher (<= 40 bit), broken protocol (SSLv2 or SSLv3) or broken certificate signing algorithm (MD5)
.br
Yellow          Weak cipher (<= 56 bit or RC4) or weak certificate signing algorithm (SHA-1)
.br
Purple          Anonymous cipher (ADH or AECDH)

\fBsslscan\fP can also output results into an XML file for easy consumption by external programs.

.SH OPTIONS
.TP
.B \-\-help
.br
Show summary of options
.TP
.B \-\-targets=<file>
A file containing a list of hosts to
check. Hosts can be supplied with
ports (i.e. host:port). One target per line
.TP
.B \-\-sni\-name=<name>
Use a different hostname for SNI
.br
.TP
.B \-\-ipv4, \-4
.br
Force IPv4 DNS resolution.
Default is to try IPv4, and if that fails then fall back to IPv6.
.TP
.B \-\-ipv6, \-6
.br
Force IPv6 DNS resolution.
Default is to try IPv4, and if that fails then fall back to IPv6.
.TP
.B \-\-show\-certificate
Display certificate information.
.TP
.B \-\-no\-check\-certificate
Don't flag certificates signed with weak algorithms (MD5 and SHA-1) or short (<2048 bit) RSA keys
.TP
.B \-\-show\-client\-cas
Show a list of CAs that the server allows for client authentication. Will be blank for IIS/Schannel servers.
.TP
.B \-\-show\-ciphers
Show a complete list of ciphers supported by sslscan
.TP
.B \-\-show\-cipher-ids
Print the hexadecimal cipher IDs
.TP
.B \-\-iana\-names
Use IANA/RFC cipher names rather than OpenSSL ones
.TP
.B \-\-show\-times
Show the time taken for each handshake in milliseconds. Note that only a single request is made with each cipher, and that the size of the ClientHello is not constant, so this should not be used for proper benchmarking or performance testing.

You might want to also use \-\-no\-cipher\-details to make the output a bit clearer.
.TP
.B \-\-ssl2
.br
Only check if SSLv2 is enabled
.TP
.B \-\-ssl3
.br
Only check if SSLv3 is enabled
.TP
.B \-\-tls10
.br
Only check TLS 1.0 ciphers
.TP
.B \-\-tls11
.br
Only check TLS 1.1 ciphers
.TP
.B \-\-tls12
.br
Only check TLS 1.2 ciphers
.TP
.B \-\-tls13
.br
Only check TLS 1.3 ciphers
.TP
.B \-\-tlsall
.br
Only check TLS ciphers (versions 1.0, 1.1, 1.2, and 1.3)
.TP
.B \-\-ocsp
.br
Display OCSP status
.TP
.B \-\-pk=<file>
A file containing the private key or
a PKCS#12 file containing a private
key/certificate pair (as produced by
MSIE and Netscape)
.TP
.B \-\-pkpass=<password>
The password for the private key or PKCS#12 file
.TP
.B \-\-certs=<file>
A file containing PEM/ASN1 formatted client certificates
.TP
.B \-\-no\-ciphersuites
Do not scan for supported ciphersuites.
.TP
.B \-\-no\-fallback
Do not check for TLS Fallback Signaling Cipher Suite Value (fallback)
.TP
.B \-\-no\-renegotiation
Do not check for secure TLS renegotiation
.TP
.B \-\-no\-compression
Do not check for TLS compression (CRIME)
.TP
.B \-\-no\-heartbleed
Do not check for OpenSSL Heartbleed (CVE-2014-0160)
.TP
.B \-\-no\-groups
Do not enumerate key exchange groups
.TP
.B \-\-show\-sigs
Enumerate signature algorithms
.TP
.B \-\-starttls\-ftp
STARTTLS setup for FTP
.TP
.B \-\-starttls\-imap
STARTTLS setup for IMAP
.TP
.B \-\-starttls\-irc
STARTTLS setup for IRC
.TP
.B \-\-starttls\-ldap
STARTTLS setup for LDAP
.TP
.B \-\-starttls\-pop3
STARTTLS setup for POP3
.TP
.B \-\-starttls\-smtp
STARTTLS setup for SMTP
.TP
.B \-\-starttls\-mysql
STARTTLS setup for MySQL
.TP
.B \-\-starttls\-xmpp
STARTTLS setup for XMPP
.TP
.B \-\-starttls\-psql
STARTTLS setup for PostgreSQL
.TP
.B \-\-xmpp-server
Perform a server-to-server XMPP connection. Try this if --starttls-xmpp is failing.
.TP
.B \-\-rdp
.br
Send RDP preamble before starting scan.
.TP
.B \-\-bugs
.br
Enables workarounds for SSL bugs
.TP
.B \-\-timeout=<sec>
.br
Set socket timeout. Useful for hosts that fail to respond to ciphers they don't understand. Default is 3s.
.TP
.B \-\-connect\-timeout=<sec>
.br
Set initial connection timeout. Useful for hosts that are slow to respond to the initial connect(). Default is 75s.
.TP
.B \-\-sleep=<msec>
.br
Pause between connections. Useful on STARTTLS SMTP services, or anything else that's performing rate limiting. Default is disabled.
.TP
.B \-\-xml=<file>
.br
Output results to an XML file. - can be used to mean stdout.
.br
.TP
.B \-\-version
Show version of program
.TP
.B \-\-verbose
Display verbose output
.TP
.B \-\-no\-cipher\-details
.br
Hide NIST EC curve name and EDH/RSA key length.
.TP
.B \-\-no-colour
.br
Disable coloured output.
.SH EXAMPLES
.LP
Scan a local HTTPS server
.RS
.nf
sslscan localhost
sslscan 127.0.0.1
sslscan 127.0.0.1:443
sslscan [::1]
sslscan [::1]:443
.SH AUTHOR
sslscan was originally written by Ian Ventura-Whiting <fizz@titania.co.uk>.
.br
sslscan was extended by Jacob Appelbaum <jacob@appelbaum.net>.
.br
sslscan was extended by rbsec <robin@rbsec.net>.
.br
This manual page was originally written by Marvin Stark <marv@der-marv.de>.