tlsanalyzer documentation
Dependency-free TLS inspection CLI
Inspect TLS protocol support, negotiated and probed cipher evidence, certificate trust, CI policy gates and machine-readable reports from a small Go binary with no runtime dependencies.
Project status: beta-readiness review on the
v0.31.x
line. Feature growth is paused; patch releases are limited to bug fixes,
documentation updates and compatibility-preserving hardening while the project
gathers real-world usage before a future beta/v1 decision. Endpoint
compatibility reports and automation feedback are welcome.
Quick Start
tlsanalyzer --host example.com
tlsanalyzer --host example.com --policy modern
tlsanalyzer --host example.com --json
tlsanalyzer --host example.com --markdown example.com.md
Container image:
docker run --rm ghcr.io/olelbis/tlsanalyzer:v0.31.3 --host example.com --no-clear
Documentation Map
User manual
Installation, CLI flags, config files, batch scans, reports and policy checks.
JSON schema v1
Stable machine-readable output for single-target and batch scans.
Compatibility policy
Preview stability promises for CLI, JSON, policy and release behavior.
TLS probe package
Preview Go API for ClientHello-only TLS 1.3 cipher evidence.
Sample report
Human-readable Markdown report with TLS 1.3 raw-probe evidence.
Output examples
Small console, JSON, Markdown and CI snippets with evidence semantics.
Validation matrix
Manual real-world smoke checks for release confidence.
Feedback reports
What to report, useful commands and issue guidance for real-world usage.
Readiness audit
Current beta/v1 posture, known limits and remaining decisions.
Beta-readiness audit
Final preview contract review before a beta decision.
What It Reports
| Area | Evidence |
|---|---|
| TLS protocol support | TLS 1.0 through TLS 1.3 support, status and attempt duration. |
| Cipher suites | Negotiated, probed, raw-probed or observed cipher evidence depending on TLS version and scan mode. |
| TLS 1.3 raw probes | ClientHello-only ServerHello evidence with selected key share group, HelloRetryRequest and alert metadata. |
| Certificates | Trust status, issuer, subject, SANs, expiry, public key and signature details. |
| CI policy | Exit codes, modern policy checks, SARIF output and JUnit XML output. |
Release Artifacts
Each release publishes:
- Linux, macOS and Windows binaries for amd64 and arm64.
- Debian and RPM packages for Linux amd64 and arm64.
- Multi-arch container images on GitHub Container Registry.
- Checksums, SBOM and GitHub artifact attestations.
TLS 1.3 Note
Go’s standard TLS API does not allow a caller to force individual TLS 1.3 cipher
suites in a full handshake. tlsanalyzer therefore uses a minimal raw
ClientHello probe when cipher probing is enabled. Reports label this evidence
explicitly as ClientHello-only and do not claim full-handshake completion for
raw TLS 1.3 probes.