# Testssl Sh

> Use for TLS and certificate posture review during authorized pentests. Trigger on checking protocol support, cipher posture, certificate hygiene, and internet-facing HTTPS hardening gaps.

- Skill: `timsonner/testssl-sh` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/testssl-sh`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/testssl-sh/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/testssl-sh

---


# Testssl.sh

## Purpose

Use this skill when the question is whether a service's TLS posture matches expected hardening.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Retest and Closure

## Use When

- Need to assess protocol support, certificate hygiene, or TLS hardening.
- Need to validate whether an exposed HTTPS service aligns to policy.
- Need to confirm that a TLS remediation actually took effect.

## Avoid When

- The target is not an approved HTTPS endpoint.
- The issue is application logic rather than transport security.

## Inputs

- Approved HTTPS targets
- Expected policy baseline or accepted hardening standard

## Procedure

1. Test only the approved endpoints.
2. Compare observed protocol and certificate posture to the agreed baseline.
3. Separate material weaknesses from policy deviations with low practical impact.
4. Tie results to exposed asset criticality.
5. Preserve the baseline comparison for retest.

## Command Syntax

Replace sample targets with approved in-scope assets.

```bash
# Full TLS assessment
./testssl.sh https://portal.contoso.com

# Fast check (skip less common ciphers)
./testssl.sh --fast portal.contoso.com:443

# Check protocols and per-protocol ciphers
./testssl.sh --protocols --cipher-per-proto portal.contoso.com:443

# Check for known TLS vulnerabilities (POODLE, BEAST, Heartbleed, etc.)
./testssl.sh --vuln portal.contoso.com:443

# Output to JSON file
./testssl.sh --jsonfile contoso-tls.json portal.contoso.com:443

# Test SMTP with STARTTLS
./testssl.sh --starttls smtp mail.contoso.com:25

# Non-standard HTTPS port
./testssl.sh portal.contoso.com:8443
```

## Evidence to Capture

- Protocol and certificate posture for each target
- Internet-facing weaknesses that increase downgrade or interception risk
- Remediation deltas during retest

## Safety Boundaries

- Keep testing limited to approved hosts.
- Report business impact in context rather than overstating raw cryptographic terminology.