Skip to main content

tls-assistant

The tls-assistant tool is a modular TLS/SSL analysis framework (based on FBK's TLSAssistant) that identifies a wide range of TLS vulnerabilities and assesses server configurations against established security guidelines. It combines multiple scanning engines — testssl.sh, tlsfuzzer, and TLS-Scanner — behind a single interface and returns actionable, mitigation-oriented findings for each analyzed host.

Ideal Use Cases & Fit​

tls-assistant is ideal for in-depth TLS posture assessment where a single pass should surface both the vulnerability and how to remediate it. It excels in contexts such as:

  • Vulnerability assessment of TLS endpoints, detecting issues such as Heartbleed, POODLE, DROWN, ROBOT, BREACH, CRIME, FREAK, Logjam, and Sweet32, along with weak ciphers and certificate problems.
  • HSTS and transport-security reviews, checking whether HTTPS is enforced and whether HSTS is correctly set and preloaded.
  • Compliance checks against agency-issued guidelines (AgID, ANSSI, BSI, Mozilla, NIST) to validate a server's configuration against a chosen standard.
  • Batch assessment across many hosts, with each host analyzed independently so one failure does not stop the run.

It focuses on server-side TLS and transport security; it is not intended for deep application-layer testing.

Value in Workflows​

In security workflows, tls-assistant adds value at the assessment stage by pairing detection with remediation guidance. Rather than only flagging a weakness, each finding carries a description and concrete mitigation (including Apache and Nginx configuration snippets where applicable), which lets teams move from discovery to fix within the same workflow. Its structured per-host output feeds cleanly into reporting, triage, and compliance-tracking steps downstream.

Input Data​

The tool expects a file containing a newline-separated list of hostnames to analyze. This input is required. Blank lines and lines beginning with # are ignored.

Example:

www.fbk.eu
example.com
badssl.com

Output Data​

Results are emitted as JSONL — one JSON object per host. Each object contains the target hostname and a results map keyed by the modules that ran, where every finding includes its name, description, and mitigation. Hosts that cannot be analyzed appear with an error field instead, so a single failure never aborts the batch.

Configuration​

  • modules: Space-separated list of specific modules to run instead of the full server profile (e.g. breach crime freak). Omit to run all server checks.
  • exclude: Space-separated list of modules to exclude from the analysis (e.g. certificate_transparency).
  • guidelines: Check compliance against a named guideline (e.g. nist, mozilla, bsi, anssi, agid). Requires the OpenSSL constraint to be satisfied or ignored.
  • ignore-openssl: Ignores the OpenSSL version constraint during configuration and compliance analysis (default is false). Updated: 2026-07-09