Skip to main content

qramm-tls-analyzer

The qramm-tls-analyzer tool is a TLS/SSL security and post-quantum cryptography (PQC) readiness analyzer for automated security workflows within Canva. Beyond classic TLS assessment — protocol versions, cipher strength, certificate validation, and known vulnerabilities — it scores each target's exposure to quantum threats and its alignment with the NSA CNSA 2.0 migration timeline.

Ideal Use Cases & Fit​

qramm-tls-analyzer is ideal for scenarios that combine conventional TLS hygiene checks with forward-looking quantum-readiness assessment. It excels in contexts such as:

  • PQC readiness audits to identify hosts vulnerable to "harvest-now-decrypt-later" attacks and track CNSA 2.0 compliance.
  • TLS configuration reviews to detect deprecated protocols, weak cipher suites, and certificate issues (expired, self-signed, mismatched).
  • Compliance checks against named security policies (modern, strict, and CNSA 2.0 deadline variants) or a custom policy file.
  • Batch reconnaissance across many domains, producing machine-readable results for downstream processing.

It is not suitable for environments requiring deep packet inspection or application-layer analysis; it evaluates the TLS handshake and certificate chain only.

Value in Workflows​

In security workflows, qramm-tls-analyzer adds value at the reconnaissance and assessment stages by surfacing both immediate TLS misconfigurations and longer-term quantum risk in a single pass. Its letter grade, quantum grade, and CNSA 2.0 timeline scoring let teams prioritize remediation, while its structured JSON output feeds naturally into reporting, triage, and compliance-tracking steps further down the workflow.

Input Data​

The tool expects a newline-separated list of hostnames or IP addresses as input. This input is required and specifies the target hosts to scan. Blank lines and lines beginning with # are ignored.

Example:

example.com
192.168.1.1
subdomain.example.com

Output Data​

Results are emitted as JSONL — one compact JSON object per target — capturing supported protocols, cipher suites, key exchanges, certificate details, detected vulnerabilities, quantum risk scoring, overall grade, and CNSA 2.0 timeline status.

Configuration​

  • format: Output format (text, json, sarif, cbom, html). Defaults to json for structured results.
  • compact: Emits single-line JSON, producing valid JSONL when scanning multiple targets. Enabled by default.
  • timeout: Connection timeout in seconds (default 30).
  • port: TLS port to connect to (default 443).
  • sni: Overrides the SNI hostname sent in the TLS ClientHello.
  • policy: Named security policy to evaluate against (modern, strict, cnsa-2.0-2027, cnsa-2.0-2030, cnsa-2.0-2035).
  • policy-file: Path to a custom YAML policy file to evaluate against.
  • skip-vulns: Skips known-vulnerability checks (BEAST, POODLE, weak algorithms, expired certs).
  • skip-quantum: Skips post-quantum readiness and quantum risk scoring.
  • skip-cnsa2: Skips CNSA 2.0 compliance evaluation. Updated: 2026-07-06