Alternatives to testssl.sh
A free command-line tool that checks a server's TLS/SSL ciphers, protocols and cryptographic flaws. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
testssl.sh
A free command-line tool that checks a server's TLS/SSL ciphers, protocols and cryptographic flaws.
Replacements
Listings that take over the same core job as testssl.sh.
SSLyze
Open-source command-line scanner and Python library that analyzes a server's SSL/TLS configuration.
SSLyze is an open-source command-line scanner that also works as a Python library with JSON output and Docker images, suited to automation in CI.
SSL Labs Server Test
A Qualys web service that analyses the TLS/SSL configuration of a public web server.
SSL Labs Server Test is a free Qualys web service with a letter grade and nothing to install, but it only tests public web servers.
ImmuniWeb SSL Security Test
A free online test of the SSL/TLS setup of a web or email server.
ImmuniWeb SSL Security Test is a free web tool covering web and email servers with compliance checks and PDF export, limited to internet-reachable servers.
CryptCheck
A web tool that checks the TLS configuration of HTTPS, SMTP and XMPP servers.
CryptCheck is a web tool that checks TLS on HTTPS, SMTP and XMPP servers without installing anything, though its interface is in French.
Hardenize
A web site configuration tester and monitoring service for network, certificate and security settings.
Hardenize is a hosted freemium tester with a public configuration report and continuous certificate monitoring for organisations, instead of a local script.
GF.dev TLS Cipher Suite Scanner
A free web tool that reports the TLS version and cipher suite a server negotiates.
GF.dev TLS Cipher Suite Scanner is a quick web check of the negotiated TLS version and cipher, without testing every protocol or known flaw.
CDN77 TLS Test
A free web checker from CDN77 that lists the SSL and TLS versions a server supports.
CDN77 TLS Test is a free web checker listing enabled SSL and TLS versions with deprecated ones highlighted, giving less detail than testssl.sh.
Also worth comparing
These listings name testssl.sh as their own alternative, so the relationship runs both ways.
Decoder.link SSL Checker
An online SSL checker that validates a server's certificate installation, with SNI and STARTTLS support.
testssl.sh is an open-source command-line script that tests any port and checks ciphers and flaws beyond certificate installation.
DigiCert SSL Installation Checker
A DigiCert web tool that diagnoses TLS/SSL certificate installation problems on a server.
testssl.sh is an open-source command-line script run from your own machine that checks ciphers, protocols and flaws on any port.
Similar software
Related functionality, not a direct replacement.
SSL Shopper SSL Checker
An online checker that verifies a server's SSL certificate installation, chain, hostname and expiry.
crt.sh
A free web search engine for certificates recorded in public Certificate Transparency logs.
CAA Test
A web tool that checks the DNS CAA records published for a domain.
CheckTLS
A web tool that tests whether a recipient's mail server accepts secure TLS connections for email.
Security Headers
A web service that analyses a site's HTTP response headers and grades them from A+ to F.
