SxTLSCheck (ScalarX TLS Checker)
SxTLSCheck is a GPL-licensed Bash script designed to quickly audit an endpoint’s TLS configuration (host or URL) using only openssl s_client. It is designed for operational use: rapid diagnostics, compatibility checks, and checks of concrete security points (protocols, certificates, handshake, advanced TLS options).
I previously used the Qualys TLS scanner test (sslabs), but had the unpleasant surprise of discovering that it no longer existed. Rather than move to yet another online service, I preferred to develop my own tool in Bash to meet my needs, with the advantage of running locally and working even without an Internet connection.
It works in heterogeneous environments (different OpenSSL versions) and adapts certain tests to the local capabilities detected through openssl s_client -help.
Main features
Usability and compatibility:
– Supports input as host, host:port, URL, and IPv6 in the form [addr] or [addr]:port (explicitly rejects IPv6 without brackets).
– Parameters: –port, –sni, –timeout, –quiet, –no-color, –date, –full-ciphers.
– Timeout through the timeout command if available, otherwise falls back to running without a timeout.
– Detects local support for OpenSSL flags (conditional tests).
Handshake and TLS layer:
– Basic handshake test and extraction of Protocol + Cipher.
– Pragmatic detection of common errors (handshake failure, no peer certificate, timeout, refused, alert).
Supported protocols:
– Explicit tests: TLS 1.0, TLS 1.1, TLS 1.2, TLS 1.3.
– Legacy tests if supported locally: SSLv2, SSLv3.
– Tests TLS_FALLBACK_SCSV (downgrade protection) if the flag is available.
Certificate and chain:
– Retrieves the leaf certificate (-showcerts), extracts dates, subject/issuer, signature algorithm, key type and size.
– Basic X509 checks: Basic Constraints, Key Usage, Extended Key Usage (serverAuth).
– Extracts SANs (DNS / IP) and checks hostname <-> certificate matching, with strict “left-most label” wildcard handling.
– Chain check: detects weak intermediate certificates (md5/sha1), expired ones, or keys that are too short.
– Detects must-staple through the TLS Feature extension (status_request).
Encryption:
– Quick tests of weak families on TLS 1.2: NULL, aNULL, EXPORT, RC4, 3DES, DES, MD5, SHA1.
– A –full-ciphers mode to enumerate all TLS 1.2 ciphers (slower) and flag weak ciphers.
Date-only mode
The –date (or -d) mode gets straight to the essentials: checking that the certificate can be retrieved, that the name matches, and estimating the number of days left before expiry.
sxtlscheck --date example.com
sxtlscheck --date https://example.com
sxtlscheck --date [2001:db8::1]
Usage
Standard audit:
sxtlscheck example.com
sxtlscheck example.com:8443
sxtlscheck https://example.com
sxtlscheck [2001:db8::1]:443
Force a different SNI (reverse proxy / multiple certificates):
sxtlscheck --sni site.example.com 1.2.3.4
Custom timeout:
sxtlscheck --timeout 3 example.com
Minimal output:
sxtlscheck --quiet example.com
Disable colours:
sxtlscheck --no-color example.com
Full enumeration of TLS 1.2 ciphers:
sxtlscheck --full-ciphers example.com
Technical architecture
Engine: OpenSSL s_client.
– Tests run through wrappers (with or without SNI) and optional timeouts.
– Capabilities are detected locally through openssl s_client -help before certain flags are used.
– Output is parsed pragmatically (grep/awk/sed) to extract protocols, ciphers, errors and X509 elements.
SAN parsing and matching:
– Extracts SAN DNS: and IP Address: through output normalisation and comma splitting.
– Deliberately restricted wildcard matching: supports *.domain.tld only on the first label.
Execution housekeeping:
Dedicated temporary directory (/tmp/sxtlscheck-$$) + cleanup through trap.
Design notes
SxTLSCheck is a diagnostic tool for use “in the field”: no exotic dependencies, no framework, only Unix primitives + OpenSSL. The aim is to provide an actionable answer in a few seconds:
“ Which protocols work, which ones should be disabled? ”
“ Is the certificate sound, and does it match the host/SNI? ”
“ Are there warning signs (legacy, downgrade, weak algorithm, questionable chain)? ”
Todo list
Explicit support for OpenSSL 3.x vs 1.1.x in certain output fields (even more robust parsing).
Resources
Script: sxtlscheck.sh
—
Christophe Casalegno (find all my social networks at: all.bo)