SSLyze is a fast and powerful SSL/TLS scanning tool and Python library.
SSLyze addresses the need to verify that servers use strong encryption settings and are not vulnerable to known TLS attacks. It works by connecting to a server and analyzing its SSL/TLS configuration, checking cipher suites, certificate validity, elliptic curves, and testing for vulnerabilities like Heartbleed, ROBOT, and OpenSSL CCS injection. The tool emphasizes speed and reliability, designed to scan hundreds of thousands of servers reliably.
SSLyze suits security teams and DevOps engineers who need to audit TLS configurations at scale. It works well for continuous compliance checking in CI/CD pipelines, where it can validate servers against Mozilla's recommended TLS configurations (old, intermediate, or modern) and return a non-zero exit code on non-compliance. Custom TLS configuration files can also be provided for organization-specific requirements. Beyond HTTPS servers, the tool supports scanning SMTP, XMPP, LDAP, POP, IMAP, RDP, Postgres, and FTP servers. A fully documented Python API enables integration into custom applications, including serverless deployments. Results export to JSON for downstream processing.
The project maintains active test coverage with continuous integration workflows. Development activity shows consistent engagement with the codebase through regular updates and maintenance of the testing infrastructure.
