TLS Analyzer: quantum-ready security assessment

Why TLS analysis matters

TLS (Transport Layer Security) is the backbone of internet security, protecting data in transit across billions of connections daily. As quantum computing advances, the cryptographic algorithms underlying TLS face an existential threat.

TLS Analyzer helps you understand:

• Protocol versions - Which TLS versions are supported (1.0, 1.1, 1.2, 1.3)
• Cipher suites - What encryption algorithms are in use
• Key exchange - Whether forward secrecy is enabled
• Certificate details - Signature algorithms, key sizes, expiration
• Quantum risk - How vulnerable are your connections to future quantum attacks

What is TLS Analyzer

TLS Analyzer is an open-source security assessment tool that scans TLS/SSL endpoints and evaluates them against modern security standards and the CNSA 2.0 quantum-readiness timeline.

Getting started

Installation

Clone and build TLS Analyzer from source:

git clone https://github.com/csnp/tls-analyzer.git
cd tls-analyzer
go build -o tlsanalyzer ./cmd/tlsanalyzer

Basic usage

Scan a single target:

# Scan a host (default port 443)
tlsanalyzer example.com

# Scan a specific port
tlsanalyzer example.com:8443

# Scan multiple targets: one host per line in a file
printf 'example.com\napi.example.com\nmail.example.com\n' > hosts.txt
tlsanalyzer --targets hosts.txt

Common options

# Output as JSON
tlsanalyzer example.com --format json

# Generate HTML report
tlsanalyzer example.com --format html --output report.html

# Generate SARIF for GitHub Security
tlsanalyzer example.com --format sarif --output results.sarif

# Generate Cryptographic Bill of Materials
tlsanalyzer example.com --format cbom --output tls-cbom.json

# Apply a security policy
tlsanalyzer example.com --policy strict

# Batch scan from file
tlsanalyzer --targets hosts.txt

CNSA 2.0 timeline

The Commercial National Security Algorithm Suite (CNSA) 2.0 establishes a timeline for transitioning to quantum-resistant cryptography. TLS Analyzer tracks your compliance against these milestones:

Security grading system

TLS Analyzer assigns letter grades based on protocol support, cipher strength, certificate quality, and quantum readiness:

Scoring factors

• Protocol Support (25%) - TLS 1.3 preferred, TLS 1.0/1.1 penalized
• Cipher Strength (25%) - Forward secrecy, key sizes, deprecated algorithms
• Certificate Quality (25%) - Signature algorithm, key size, chain validity
• Quantum Readiness (25%) - Hybrid key exchange, PQC algorithm support

Output formats

HTML reports

Generate professional HTML reports for stakeholder communication:

tlsanalyzer example.com --format html --output tls-report.html

HTML reports include visual grade indicators, detailed findings, and remediation recommendations.

SARIF (GitHub security integration)

SARIF integrates directly with GitHub's Security tab for automated scanning:

tlsanalyzer example.com --format sarif --output results.sarif

CBOM (cryptographic bill of materials)

Generate CycloneDX-compatible CBOMs for compliance and supply chain transparency:

tlsanalyzer example.com --format cbom --output tls-cbom.json

CBOMs document all cryptographic components discovered during the scan, including algorithms, key sizes, and protocol versions.

Policy-based scanning

Built-in policies

# List available policies
tlsanalyzer policies

# Apply the strict policy
tlsanalyzer example.com --policy strict

# Apply the modern policy
tlsanalyzer example.com --policy modern

Custom policies

Define custom policies in YAML for organization-specific requirements. From 0.4.0 an unknown key is refused rather than silently ignored, so start from a file the tool prints for you and edit that: tlsanalyzer print-policy modern > my-policy.yaml. To inherit a built-in policy and override individual rules, add extends: modern rather than restating the whole file.

# my-policy.yaml
name: corporate-standard
version: "1.0"
description: Corporate TLS requirements
rules:
  protocol:
    minVersion: TLS 1.2
    bannedVersions:
      - TLS 1.0
      - TLS 1.1
  cipher:
    minKeySize: 128
    requireForwardSecrecy: true
    bannedAlgorithms:
      - 3DES
      - RC4
      - MD5
      - SHA1
  certificate:
    minValidityDays: 30
    minRsaKeySize: 2048
    bannedSignatureAlgorithms:
      - SHA1
      - MD5
    allowSelfSigned: false

Apply your custom policy:

tlsanalyzer example.com --policy-file my-policy.yaml

CI/CD integration

GitHub Actions

name: TLS Security Scan
on:
  schedule:
    - cron: '0 6 * * 1'  # Weekly on Monday
  workflow_dispatch:

jobs:
  tls-scan:
    runs-on: ubuntu-latest
    steps:
      - name: Setup Go
        uses: actions/setup-go@v5
        with:
          go-version: '1.21'

      - name: Install TLS Analyzer
        run: |
          git clone --depth 1 https://github.com/csnp/tls-analyzer.git
          cd tls-analyzer && go build -o /usr/local/bin/tlsanalyzer ./cmd/tlsanalyzer

      - name: Scan Production Endpoints
        run: |
          printf 'api.example.com\napp.example.com\n' > hosts.txt
          tlsanalyzer \
            --targets hosts.txt \
            --format sarif \
            --output tls-results.sarif \
            --policy modern
      # Exit 2 means the policy was evaluated and not satisfied, which is what
      # fails this job. Exit 1 means a host could not be scanned, so there is no
      # verdict. Exit 0 means every target satisfied the policy.

      - name: Upload SARIF Results
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: tls-results.sarif

GitLab CI

tls-security-scan:
  image: golang:1.21
  stage: security
  script:
    - git clone --depth 1 https://github.com/csnp/tls-analyzer.git
    - cd tls-analyzer && go build -o /usr/local/bin/tlsanalyzer ./cmd/tlsanalyzer
    - echo "$PRODUCTION_HOSTS" | tr ' ' '\n' > hosts.txt
    - tlsanalyzer --targets hosts.txt --format json --output tls-report.json
  artifacts:
    reports:
      security: tls-report.json
  only:
    - schedules

Related resources

• CryptoScan Guide - Discover cryptographic assets in your codebase
• NIST PQC Standards Guide - Understanding the standardized algorithms
• Crypto Agility - Building flexibility into cryptographic systems
• Harvest Now, Decrypt Later - Understanding the HNDL threat