sslyze

What it is and what it does

SSLyze is a Python library and command-line tool for analyzing the SSL/TLS configuration of remote servers. It connects to a server, inspects its certificate, supported cipher suites, protocol versions, and elliptic curves, then reports on encryption strength and known vulnerabilities like Heartbleed, ROBOT, and OpenSSL CCS injection. It supports scanning non-HTTP servers including SMTP, XMPP, LDAP, POP, IMAP, RDP, Postgres, and FTP.

The tool is designed for both one-off security audits and continuous compliance checking. It can validate server configurations against Mozilla's recommended TLS profiles (old, intermediate, modern) or custom JSON-defined policies, making it suitable for CI/CD integration. Results can be exported to JSON for further processing. The library exposes a full Python API for embedding scans into applications, such as Lambda functions or custom security tools.

Use it for:

• Audit a web server's TLS configuration to identify weak ciphers or outdated protocol versions before deployment.
• Run SSLyze as a CI/CD step to enforce Mozilla's modern TLS configuration and fail builds that don't comply.
• Scan SMTP or LDAP servers to verify they support strong encryption and are not vulnerable to known attacks.
• Build a security monitoring dashboard that periodically scans your organization's servers and exports results to JSON for alerting.
• Test a custom TLS policy by defining allowed certificate types, cipher suites, and versions in a JSON file and validating servers against it.

Worth the install?

AI-flagged interpretation of the facts on this page — verify before relying

SSLyze is a fast SSL/TLS scanning tool and Python library that analyzes server configurations for encryption strength and known TLS vulnerabilities by connecting and inspecting certificate, cipher suites, and protocol settings.

Yes, with conditions. SSLyze is actively maintained, has no known vulnerabilities, and is well-suited for TLS auditing and compliance checking. However, the AGPL license is restrictive—proprietary projects must either accept copyleft obligations or avoid it. High install friction (native dependencies) may complicate deployment in some environments. Install if you need TLS scanning and can accept AGPL terms.

Install

sslyze on PyPI

pip install sslyze

uv add sslyze

poetry add sslyze

Installing sslyze

Before you install

High install friction due to compiled dependencies (nassl, cryptography, tls-parser). The package is actively maintained with recent releases and a stable repository, but setup requires building native extensions.

License in practice

SSLyze is licensed under AGPL, which requires that any modifications or derivative works using this library must also be released under AGPL. This is a copyleft license with strong reciprocal obligations; proprietary or closed-source projects should verify compatibility before depending on it.

Quickstart

pip install sslyze
python -m sslyze www.example.com

# Or via Python API:
from sslyze import ServerScanRequest, Scanner
request = ServerScanRequest(hostname="www.example.com")
scanner = Scanner()
results = scanner.run(request)

Requires Python 3.10 or later. Native compilation dependencies (nassl, cryptography) must build successfully on your platform.

Verify before relying

• Whether the AGPL license applies to indirect use (e.g., calling sslyze from a web service) and what derivative-work obligations that triggers
• Performance characteristics when scanning hundreds of thousands of servers as claimed in the description

Package facts

Evidence: sslyze-6.3.1.tar.gz

Keywords: ssl, tls, scan, security, library

Tags

More Monitoring packages