# tlsx: TLS configuration and certificate recon

> How to install and run tlsx, what its certificate output reveals about an attack surface, and how Tandera uses it across fingerprint and active scan.

`tlsx` connects to a TLS service and reports what it finds: certificate subject and SAN entries, issuer, expiry, protocol versions, cipher suites, JARM hash. It is both a configuration checker and a discovery tool — certificate SANs routinely name hostnames that no passive source knows about.

## Install

```bash
go install -v github.com/projectdiscovery/tlsx/cmd/tlsx@latest
```

## Core commands

```bash
# basic handshake detail
tlsx -l hosts.txt -silent

# pull SAN entries — this is discovery, not just inspection
tlsx -l hosts.txt -san -cn -silent -resp-only

# expiry and issuer
tlsx -l hosts.txt -expired -self-signed -mismatched -silent

# protocol and cipher enumeration
tlsx -l hosts.txt -tls-version -cipher -silent

# JSON
tlsx -l hosts.txt -json -o tls.jsonl -san -cn -jarm
```

## Output

```json
{"host":"example.com","port":"443","tls_version":"tls12","cipher":"TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256",
 "not_after":"2026-11-02T12:00:00Z","subject_cn":"example.com",
 "subject_an":["example.com","www.example.com","internal-api.example.com"],
 "issuer_org":["Let's Encrypt"],"self_signed":false}
```

## Where it sits in Tandera

tlsx is scheduled in two phases. In **fingerprint** it runs against the live-host set to record certificate and protocol detail. In **active_scan** on `recon_web_full` it performs the deeper protocol and cipher enumeration that a `NonIntrusive` flow will not do.

The SAN entries it recovers feed back into the host inventory — a certificate naming `internal-api.example.com` puts that hostname into scope discovery even if no passive source ever saw it.

## Using it in a pentest

**Read the SANs before you read the cipher list.** A shared certificate is a map of the organisation's internal naming. `internal-`, `staging-`, `vpn-` and `admin-` prefixes in a public certificate are the highest-value output this tool produces.

**Weak ciphers are a finding, but rate them honestly.** TLS 1.0 on a public login page and TLS 1.0 on a legacy internal service are not the same risk. A report that lists both as High loses credibility.

**Expiry dates are operational intelligence.** A certificate expiring in nine days tells you something about how the target is maintained, and is worth a line in the report even though it is not a vulnerability.

---

Canonical: https://tandera.io/tools/tlsx
This page as markdown: https://tandera.io/tools/tlsx.md
Index for agents: https://tandera.io/llms.txt

Every page here is also available as markdown: append `.md` to the path (e.g. `/recon.md`, `/index.md` for this homepage, `/blog/<slug>.md`), or request the canonical path with `Accept: text/markdown`.