Every type of TLS check that SSLyze can run against a server (supported cipher suites, session renegotiation, etc.) is
represented by a ScanCommand, which, when run against a server, will return a specific result.
This page lists all the ScanCommand and their corresponding results available in the current release of SSLyze.
Release 6.0.0
-
-
+Release 6.1.0
+
+
+
+
SSLyze is a fast and powerful SSL/TLS scanning tool and Python library.
SSLyze can analyze the SSL/TLS configuration of a server by connecting to it, in order to ensure that it uses strong encryption settings (certificate, cipher suites, elliptic curves, etc.), and that it is not vulnerable to known TLS @@ -109,6 +114,7 @@
def main() -> None:
print("=> Starting the scans")
- date_scans_started = datetime.utcnow()
+ date_scans_started = datetime.now(timezone.utc)
# First create the scan requests for each server that we want to scan
try:
@@ -159,7 +161,7 @@ Full Example# Lastly, save the all the results to a JSON file
json_file_out = Path("api_sample_results.json")
print(f"\n\n=> Saving scan results to {json_file_out}")
- example_json_result_output(json_file_out, all_server_scan_results, date_scans_started, datetime.utcnow())
+ example_json_result_output(json_file_out, all_server_scan_results, date_scans_started, datetime.now(timezone.utc))
# And ensure we are able to parse them
print(f"\n\n=> Parsing scan results from {json_file_out}")
@@ -176,13 +178,13 @@ Classes for Starting a Scan
- Parameters:
-server_location (ServerNetworkLocation) – The server to scan.
network_configuration (ServerNetworkConfiguration) – An optional network configuration. If not supplied, a default configuration will be used.
scan_commands (Set[ScanCommand]) – An optional list of scan commands to run against the server. If not supplied, all available
+
server_location (ServerNetworkLocation) – The server to scan.
network_configuration (ServerNetworkConfiguration) – An optional network configuration. If not supplied, a default configuration will be used.
scan_commands (Set[ScanCommand]) – An optional list of scan commands to run against the server. If not supplied, all available
scan commands will be run.
scan_commands_extra_arguments (ScanCommandsExtraArguments) – An optional list of extra arguments specific to some scan commands. If not
+
scan_commands_extra_arguments (ScanCommandsExtraArguments) – An optional list of extra arguments specific to some scan commands. If not
supplied, no extra arguments will be set.
uuid (UUID) –
uuid (UUID)
Classes for Starting a Scan
- Parameters:
-hostname (str) –
port (int) –
ip_address (Optional[str]) –
http_proxy_settings (Optional[HttpProxySettings]) –
hostname (str)
port (int)
ip_address (Optional[str])
http_proxy_settings (Optional[HttpProxySettings])
Classes for Starting a Scan
- Parameters:
-per_server_concurrent_connections_limit (Optional[int]) –
concurrent_server_scans_limit (Optional[int]) –
observers (Optional[Sequence[ScannerObserver]]) –
per_server_concurrent_connections_limit (Optional[int])
concurrent_server_scans_limit (Optional[int])
observers (Optional[Sequence[ScannerObserver]])
Classes for Starting a Scan¶
-
-class sslyze.ServerNetworkConfiguration(tls_server_name_indication, tls_opportunistic_encryption=None, tls_client_auth_credentials=None, xmpp_to_hostname=None, network_timeout=5, network_max_retries=3)¶
+class sslyze.ServerNetworkConfiguration(tls_server_name_indication, tls_opportunistic_encryption=None, tls_client_auth_credentials=None, xmpp_to_hostname=None, smtp_ehlo_hostname=None, http_user_agent=None, network_timeout=5, network_max_retries=3)¶
Additional network settings to provide fine-grained control on how to connect to a specific server.
-
@@ -265,8 +267,8 @@
Additional settings: StartTLS, SNI, etc.
--
-tls_wrapped_protocol¶
+-
+tls_opportunistic_encryption¶
The protocol wrapped in TLS that the server expects. It allows SSLyze to figure out
how to establish a (Start)TLS connection to the server and what kind of “hello” message
(SMTP, XMPP, etc.) to send to the server after the handshake was completed. If not supplied, standard
@@ -285,10 +287,24 @@
Additional settings: StartTLS, SNI, etc.
xmpp_to_hostname¶
The hostname to set within the to attribute of the XMPP stream. If not supplied, the
-server’s hostname will be used. Should only be set if the supplied tls_wrapped_protocol is an
+server’s hostname will be used. Should only be set if the supplied tls_opportunistic_encryption is an
XMPP protocol.
+
+-
+http_user_agent¶
+The User-Agent to send in HTTP requests. If not supplied, a default Chrome-like
+is used that includes SSLyze’s version.
+
+
+
+-
+smtp_ehlo_hostname¶
+The hostname to set in the SMTP EHLO. If not supplied, the default of “sslyze.scan”
+will be used. Should only be set if the supplied tls_opportunistic_encryption is SMTP.
+
+
-
network_timeout¶
@@ -306,12 +322,14 @@ Additional settings: StartTLS, SNI, etc.
- Parameters:
-tls_server_name_indication (str) –
tls_opportunistic_encryption (Optional[ProtocolWithOpportunisticTlsEnum]) –
tls_client_auth_credentials (Optional[ClientAuthenticationCredentials]) –
xmpp_to_hostname (Optional[str]) –
network_timeout (int) –
network_max_retries (int) –
tls_server_name_indication (str)
tls_opportunistic_encryption (Optional[ProtocolWithOpportunisticTlsEnum])
tls_client_auth_credentials (Optional[ClientAuthenticationCredentials])
xmpp_to_hostname (Optional[str])
smtp_ehlo_hostname (Optional[str])
http_user_agent (Optional[str])
network_timeout (int)
network_max_retries (int)
@@ -319,7 +337,7 @@ Additional settings: StartTLS, SNI, etc.
-
-class sslyze.ProtocolWithOpportunisticTlsEnum(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶
+class sslyze.ProtocolWithOpportunisticTlsEnum(value, names=<not given>, *values, module=None, qualname=None, type=None, start=1, boundary=None)¶
The list of plaintext protocols supported by SSLyze for opportunistic TLS upgrade (such as STARTTLS).
This allows SSLyze to figure out how to complete an SSL/TLS handshake with the server.
@@ -417,10 +435,10 @@ Enabling SSL/TLS client authentication
- Parameters:
-certificate_chain_path (Path) –
key_path (Path) –
key_password (str) –
key_type (OpenSslFileTypeEnum) –
certificate_chain_path (Path)
key_path (Path)
key_password (str)
key_type (OpenSslFileTypeEnum)
Enabling SSL/TLS client authentication
-
-class sslyze.OpenSslFileTypeEnum(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶
+class sslyze.OpenSslFileTypeEnum(value, names=<not given>, *values, module=None, qualname=None, type=None, start=1, boundary=None)¶
Certificate and private key format constants which map to the SSL_FILETYPE_XXX OpenSSL constants.
-
@@ -498,14 +516,14 @@
Classes for Processing Scan Results
- Parameters:
-uuid (UUID) –
server_location (ServerNetworkLocation) –
network_configuration (ServerNetworkConfiguration) –
connectivity_status (ServerConnectivityStatusEnum) –
connectivity_error_trace (Optional[TracebackException]) –
connectivity_result (Optional[ServerTlsProbingResult]) –
scan_status (ServerScanStatusEnum) –
scan_result (Optional[AllScanCommandsAttempts]) –
uuid (UUID)
server_location (ServerNetworkLocation)
network_configuration (ServerNetworkConfiguration)
connectivity_status (ServerConnectivityStatusEnum)
connectivity_error_trace (Optional[TracebackException])
connectivity_result (Optional[ServerTlsProbingResult])
scan_status (ServerScanStatusEnum)
scan_result (Optional[AllScanCommandsAttempts])
@@ -513,12 +531,12 @@ Classes for Processing Scan Results
-
-class sslyze.ServerConnectivityStatusEnum(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶
+class sslyze.ServerConnectivityStatusEnum(value, names=<not given>, *values, module=None, qualname=None, type=None, start=1, boundary=None)¶
-
-class sslyze.ServerScanStatusEnum(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶
+class sslyze.ServerScanStatusEnum(value, names=<not given>, *values, module=None, qualname=None, type=None, start=1, boundary=None)¶
@@ -528,10 +546,10 @@ Classes for Processing Scan Results
- Parameters:
-highest_tls_version_supported (TlsVersionEnum) –
cipher_suite_supported (str) –
client_auth_requirement (ClientAuthRequirementEnum) –
supports_ecdh_key_exchange (bool) –
highest_tls_version_supported (TlsVersionEnum)
cipher_suite_supported (str)
client_auth_requirement (ClientAuthRequirementEnum)
supports_ecdh_key_exchange (bool)
@@ -539,28 +557,29 @@ Classes for Processing Scan Results
-
-class sslyze.AllScanCommandsAttempts(certificate_info, ssl_2_0_cipher_suites, ssl_3_0_cipher_suites, tls_1_0_cipher_suites, tls_1_1_cipher_suites, tls_1_2_cipher_suites, tls_1_3_cipher_suites, tls_compression, tls_1_3_early_data, openssl_ccs_injection, tls_fallback_scsv, heartbleed, robot, session_renegotiation, session_resumption, elliptic_curves, http_headers)¶
+class sslyze.AllScanCommandsAttempts(certificate_info, ssl_2_0_cipher_suites, ssl_3_0_cipher_suites, tls_1_0_cipher_suites, tls_1_1_cipher_suites, tls_1_2_cipher_suites, tls_1_3_cipher_suites, tls_compression, tls_1_3_early_data, openssl_ccs_injection, tls_fallback_scsv, heartbleed, robot, session_renegotiation, session_resumption, elliptic_curves, http_headers, tls_extended_master_secret)¶
The result of every scan command supported by SSLyze.
- Parameters:
-certificate_info (CertificateInfoScanAttempt) –
ssl_2_0_cipher_suites (CipherSuitesScanAttempt) –
ssl_3_0_cipher_suites (CipherSuitesScanAttempt) –
tls_1_0_cipher_suites (CipherSuitesScanAttempt) –
tls_1_1_cipher_suites (CipherSuitesScanAttempt) –
tls_1_2_cipher_suites (CipherSuitesScanAttempt) –
tls_1_3_cipher_suites (CipherSuitesScanAttempt) –
tls_compression (CompressionScanAttempt) –
tls_1_3_early_data (EarlyDataScanAttempt) –
openssl_ccs_injection (OpenSslCcsInjectionScanAttempt) –
tls_fallback_scsv (FallbackScsvScanAttempt) –
heartbleed (HeartbleedScanAttempt) –
robot (RobotScanAttempt) –
session_renegotiation (SessionRenegotiationScanAttempt) –
session_resumption (SessionResumptionSupportScanAttempt) –
elliptic_curves (SupportedEllipticCurvesScanAttempt) –
http_headers (HttpHeadersScanAttempt) –
certificate_info (CertificateInfoScanAttempt)
ssl_2_0_cipher_suites (CipherSuitesScanAttempt)
ssl_3_0_cipher_suites (CipherSuitesScanAttempt)
tls_1_0_cipher_suites (CipherSuitesScanAttempt)
tls_1_1_cipher_suites (CipherSuitesScanAttempt)
tls_1_2_cipher_suites (CipherSuitesScanAttempt)
tls_1_3_cipher_suites (CipherSuitesScanAttempt)
tls_compression (CompressionScanAttempt)
tls_1_3_early_data (EarlyDataScanAttempt)
openssl_ccs_injection (OpenSslCcsInjectionScanAttempt)
tls_fallback_scsv (FallbackScsvScanAttempt)
heartbleed (HeartbleedScanAttempt)
robot (RobotScanAttempt)
session_renegotiation (SessionRenegotiationScanAttempt)
session_resumption (SessionResumptionSupportScanAttempt)
elliptic_curves (SupportedEllipticCurvesScanAttempt)
http_headers (HttpHeadersScanAttempt)
tls_extended_master_secret (EmsExtensionScanAttempt)
@@ -598,10 +617,10 @@ Classes for Processing Scan Results
- Parameters:
-status (ScanCommandAttemptStatusEnum) –
error_reason (Optional[ScanCommandErrorReasonEnum]) –
error_trace (Optional[TracebackException]) –
result (Optional[TypeVar(_ScanCommandResultTypeVar)]) –
status (ScanCommandAttemptStatusEnum)
error_reason (Optional[ScanCommandErrorReasonEnum])
error_trace (Optional[TracebackException])
result (Optional[TypeVar(_ScanCommandResultTypeVar)])
Classes for Processing Scan Results
-
-class sslyze.ScanCommandErrorReasonEnum(value, names=None, *, module=None, qualname=None, type=None, start=1, boundary=None)¶
+class sslyze.ScanCommandErrorReasonEnum(value, names=<not given>, *values, module=None, qualname=None, type=None, start=1, boundary=None)¶
-
BUG_IN_SSLYZE = 'BUG_IN_SSLYZE'¶
@@ -640,7 +659,7 @@ Classes for Processing Scan Results
+
SSLyze
@@ -651,7 +670,16 @@ SSLyze
-Navigation
+
+
+
+
+
+
+Navigation
- Running a Scan in Python
- Overview
@@ -677,16 +705,6 @@ Related Topics
-
- Quick search
-
-
-
-
-
@@ -700,11 +718,11 @@ Quick search
- ©Copyright 2024 Alban Diquet.
+ ©Copyright 2025 Alban Diquet.
|
- Powered by Sphinx 7.2.6
- & Alabaster 0.7.13
+ Powered by Sphinx 8.1.3
+ & Alabaster 1.0.0
|
- Search — SSLyze 6.0.0 documentation
+ Search — SSLyze 6.1.0 documentation
-
+
+
-
-
+
+
-
-
+
+
+
+
+
-
@@ -59,17 +62,14 @@ Search
-
-
-
-
+