What it does
testssl.sh is a command-line tool for checking TLS or SSL support on a server port, including protocols, ciphers and known cryptographic weaknesses.
Choose the hostname and port, then distinguish direct TLS from a service that needs a STARTTLS handshake. The 3.2 manual warns that an IP-only target can reach a different virtual host; port 443 is assumed unless specified. Findings appear in the terminal and can be saved as JSON, CSV, HTML or logs. Existing nonempty output files are rejected by default; the explicit overwrite option replaces them without warning. Bash, standard Unix utilities and an OpenSSL or LibreSSL helper are required. Tests can run inside a LAN; DNS lookups and requested certificate-revocation checks are exceptions to the documented direct-client workflow. The software is GPLv2.
Strengths
- Checks a selected service port
- Protocol and cipher inspection
Watch out for
- Requires command-line setup and interpretation of results
Sources
- /bin/bash based TLS/SSL tester: testssl.sh (Oct 26, 2026)
- testssl.sh3.2 manual inputs/dependencies (Oct 26, 2026)
- testssl.sh3.2 export and overwrite controls (Oct 26, 2026)