tlsx: TLS configuration and certificate recon

tlsx · MIT

tlsx connects to a TLS service and reports what it finds: certificate subject and SAN entries, issuer, expiry, protocol versions, cipher suites, JARM hash. It is both a configuration checker and a discovery tool — certificate SANs routinely name hostnames that no passive source knows about.

Install

go install -v github.com/projectdiscovery/tlsx/cmd/tlsx@latest

Core commands

# basic handshake detail
tlsx -l hosts.txt -silent

# pull SAN entries — this is discovery, not just inspection
tlsx -l hosts.txt -san -cn -silent -resp-only

# expiry and issuer
tlsx -l hosts.txt -expired -self-signed -mismatched -silent

# protocol and cipher enumeration
tlsx -l hosts.txt -tls-version -cipher -silent

# JSON
tlsx -l hosts.txt -json -o tls.jsonl -san -cn -jarm

Output

{"host":"example.com","port":"443","tls_version":"tls12","cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 "not_after":"2026-11-02T12:00:00Z","subject_cn":"example.com",
 "subject_an":["example.com","www.example.com","internal-api.example.com"],
 "issuer_org":["Let's Encrypt"],"self_signed":false}

Where it sits in Tandera

tlsx is scheduled in two phases. In fingerprint it runs against the live-host set to record certificate and protocol detail. In active_scan on recon_web_full it performs the deeper protocol and cipher enumeration that a NonIntrusive flow will not do.

The SAN entries it recovers feed back into the host inventory — a certificate naming internal-api.example.com puts that hostname into scope discovery even if no passive source ever saw it.

Using it in a pentest

Read the SANs before you read the cipher list. A shared certificate is a map of the organisation’s internal naming. internal-, staging-, vpn- and admin- prefixes in a public certificate are the highest-value output this tool produces.

Weak ciphers are a finding, but rate them honestly. TLS 1.0 on a public login page and TLS 1.0 on a legacy internal service are not the same risk. A report that lists both as High loses credibility.

Expiry dates are operational intelligence. A certificate expiring in nine days tells you something about how the target is maintained, and is worth a line in the report even though it is not a vulnerability.