Pricing

Rating

Developer

Actor stats

Categories

Share

TLS Cipher Suite Scanner

Scan TLS cipher suites to detect weak or deprecated configurations across your entire domain inventory. Outdated ciphers like RC4 or CBC-mode suites remain a top finding in compliance audits, and many teams lack visibility until a scanner flags them. Check hundreds of hosts in parallel and get structured results ready for reporting.

Features

• Cipher suite detection — identifies the exact cipher suite negotiated during the TLS handshake
• Protocol version reporting — reports TLS 1.2, TLS 1.3, or older protocol versions for each host
• Certificate validation — checks whether the server certificate is authorized and trusted
• ALPN negotiation — reports Application-Layer Protocol Negotiation results (h2, http/1.1)
• Bulk scanning — check hundreds of domains concurrently in a single run
• Flexible input — accepts plain domains, URLs, or objects with domain/url fields

Input

Input Example

{
"domains":[
"google.com",
"github.com",
"example.com"
],
"concurrency":20
}

Output

Each domain produces one dataset record with the negotiated TLS parameters and certificate status.

Key output fields:

• domain (string) — the hostname that was scanned
• status (string) — scan result status (OK or ERROR)
• protocol (string) — negotiated TLS version (e.g., TLSv1.3)
• cipher (string) — negotiated cipher suite name (e.g., TLS_AES_256_GCM_SHA384)
• authorized (boolean) — whether the server certificate is trusted
• alpn (string) — negotiated ALPN protocol (e.g., h2)
• error (string | null) — error message if the connection failed
• checkedAt (string) — ISO 8601 timestamp

Output Example

{
"domain":"github.com",
"status":"OK",
"protocol":"TLSv1.3",
"cipher":"TLS_AES_128_GCM_SHA256",
"authorized":true,
"alpn":"h2",
"error":null,
"checkedAt":"2026-03-09T12:00:00.000Z"
}

Pricing

Pay only for hosts successfully scanned. Respects your per-run spending limit.

Use Cases

• Security audits — verify that all enterprise endpoints use TLS 1.2+ with strong cipher suites
• PCI DSS compliance — confirm no deprecated protocols or weak ciphers are in use across payment-processing domains
• Vendor risk assessment — bulk-scan third-party domains to evaluate their TLS configurations before onboarding
• Infrastructure migration — validate cipher suite consistency after moving to new hosting or CDN providers
• Scheduled monitoring — run weekly scans to detect cipher downgrades or misconfigurations after server changes

Related Actors