# Install sslscan with Homebrew, apk, apt, dnf, MacPorts, Nix, pacman, zypper, scoop Test SSL/TLS enabled services to discover supported cipher suites. Version 2.2.2 via Homebrew; verified 2026-05-12. Also installable with debian: sudo apt install sslscan. ## Install ```sh sudo av install brew:sslscan ``` Additional install commands: ### macOS - Homebrew (100%): ```sh brew install sslscan ``` Evidence: local Homebrew formula metadata - MacPorts (94%): ```sh sudo port install sslscan ``` Evidence: MacPorts ports tree: net/sslscan/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 ### Linux - apk (92%): ```sh sudo apk add sslscan ``` Evidence: Alpine Linux edge package indexes: sslscan from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz - Debian apt (92%): ```sh sudo apt install sslscan ``` Evidence: Debian stable package indexes: sslscan from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz - dnf (92%): ```sh sudo dnf install sslscan ``` Evidence: Fedora Rawhide package metadata: sslscan from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst - Nix (92%): ```sh nix profile install nixpkgs#sslscan ``` Evidence: nixpkgs package indexes: sslscan from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - pacman (92%): ```sh sudo pacman -S sslscan ``` Evidence: Arch Linux sync databases: sslscan from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz - zypper (92%): ```sh sudo zypper install sslscan ``` Evidence: openSUSE Tumbleweed package metadata: sslscan from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst ### Windows - Scoop (92%): ```sh scoop install main/sslscan ``` Evidence: Scoop official bucket manifest trees: bucket/sslscan.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Package facts - **Package key:** brew:sslscan - **Package manager:** Homebrew - **Package manager page:** - **Version:** 2.2.2 - **Source summary:** Test SSL/TLS enabled services to discover supported cipher suites - **Homepage:** - **Repository:** - **Upstream docs:** - **License:** GPL-3.0-or-later WITH cryptsetup-OpenSSL-exception - **Source archive:** - **Last updated:** 2026-05-12T11:16:46-04:00 - **Generated:** 2026-07-25T07:20:51+00:00 ## Executables - sslscan (cli) - sslscan (alias) ## Dependencies - openssl@3 ## Install behavior - Post-install hook: not defined - Bottle: available on arm64_linux, arm64_sequoia, arm64_sonoma, arm64_tahoe, sonoma, x86_64_linux ## Freshness - Page generated: 2026-07-25 - Package-manager version: 2.2.2 - Package-manager updated: 2026-05-12 - Local data: ok - Upstream repository: https://github.com/rbsec/sslscan - Upstream latest detected: 2.2.2 (current) ## Project history and usage sslscan is a command-line SSL/TLS scanner used to enumerate protocol support, cipher suites, certificates, key exchange groups, and related server properties. It is a package-manager staple because it gives admins and security testers a fast local check without relying on a hosted assessment service. ### Project history The current rbsec README identifies the project as a fork of ioerror's sslscan, which itself was a fork of Ian Ventura-Whiting's original sslscan.c and was influenced by OpenSSL s_client setup code. The rbsec fork added extensive highlighting and checks for weak protocol and cipher behavior, certificate issues, IPv6, STARTTLS modes, Heartbleed, RDP, PostgreSQL, MySQL, and other protocol contexts. Version 2 was a major rewrite of the backend scanning code. The README says this made sslscan less dependent on the OpenSSL version for many checks, allowing support for legacy protocols such as SSLv2 and SSLv3 and newer TLS 1.3 behavior regardless of the OpenSSL version used for compilation. ### Adoption history The supplied package metadata shows sslscan across apk, Homebrew, Debian, Fedora, MacPorts, Nix, Arch, Scoop, Ubuntu, and openSUSE. That breadth reflects its role as a common local TLS triage tool in Unix and cross-platform security toolboxes. The changelog records a long stream of packaging-relevant changes: static OpenSSL builds, OS X and Windows support, OpenBSD fixes, Docker builds, XML output changes, and build-system work. Those details matter to distributors because TLS scanner behavior can change when the linked OpenSSL version changes. ### How it is used Typical usage is to point sslscan at a host or target list and inspect supported protocols, cipher suites, certificate metadata, weak keys, compression, STARTTLS support, XML output, and optional checks. Users often install it through a package manager when they need quick TLS visibility from the machine they are on. Version 2's static-build guidance is important operationally: upstream recommends ignoring the system OpenSSL and statically building against a chosen OpenSSL for additional checks and predictable behavior. ### Why package nerds care sslscan is interesting to package nerds because the package is not just a wrapper around OpenSSL; the exact build strategy influences what the scanner can see. Static versus system OpenSSL linking, minimum OpenSSL versions, and legacy protocol support are part of the package's user-visible behavior. It is also a canonical example of security tooling that survived through forks: original utility, ioerror fork, rbsec-maintained fork, and then a version 2 rewrite to keep up with TLS 1.3 and post-quantum group reporting. ### Timeline - 2013: rbsec changelog records version 1.9 with highlighting for SSLv2, weak ciphers, RC4, anonymous ciphers, TLS 1.1 and 1.2 support, IPv6, and TLS compression checks. - 2014: Version 1.9.2 added the OpenSSL Heartbleed check. - 2015: Version 1.11.0 rewrote the ciphersuite scanning engine to be faster and ordered results by server preference. - 2020: Version 2.0.0-alpha1 introduced a major backend rewrite, TLS 1.3 support, legacy protocol detection independent of OpenSSL, and key exchange and signature-algorithm checks. - 2023: Version 2.1.0 moved builds to OpenSSL 3.0. - 2025: Version 2.2.0 made OpenSSL 3.5 the minimum build target and added post-quantum group support. - 2026: Version 2.2.2 fixed build behavior respecting the -j option when building OpenSSL. ### Related projects - Related tools and references include OpenSSL s_client, the earlier ioerror sslscan fork, Ian Ventura-Whiting's original sslscan.c, and TLS assessment tools such as ssllabs-scan. - The README also highlights Docker builds and Windows cross-compiled releases as related distribution surfaces. ### Sources - - - input source_facts.package-manager ## Security Notes narrow executable package without higher-risk signals. - **Geiger risk:** green / low - narrow executable package without higher-risk signals ## Source Database Details - **Source Database:** Homebrew formula API - **Tap:** homebrew/core - **Full Name:** sslscan - **Version Scheme:** 0 - **Revision:** 0 - **Head Version:** HEAD - **Bottle Stable Root URL:** - **Deprecated:** no - **Disabled:** no - **Keg Only:** no - **URL Keys:** head, stable ## Other Package-Manager Records - Debian apt - sslscan - 2.1.5-1: normalized package name match | Debian stable package indexes: sslscan from https://deb.debian.org/debian/dists/stable/main/binary-amd64/Packages.xz | Tests SSL/TLS enabled services to discover supported cipher suites | https://github.com/rbsec/sslscan - Nix - sslscan: normalized package name match | nixpkgs package indexes: sslscan from https://raw.githubusercontent.com/NixOS/nixpkgs/master/pkgs/top-level/all-packages.nix - Ubuntu apt - sslscan - 2.1.2-0.1build2: normalized package name match | Ubuntu 24.04 LTS package indexes: sslscan from https://archive.ubuntu.com/ubuntu/dists/noble/universe/binary-amd64/Packages.gz | Tests SSL/TLS enabled services to discover supported cipher suites | https://github.com/rbsec/sslscan - apk - sslscan - 2.2.2-r0: normalized package name match | Alpine Linux edge package indexes: sslscan from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | fast SSL/TLS configuration scanner | https://github.com/rbsec/sslscan - apk - sslscan-doc - 2.2.2-r0: normalized package name match | Alpine Linux edge package indexes: sslscan-doc from https://dl-cdn.alpinelinux.org/alpine/edge/community/x86_64/APKINDEX.tar.gz | fast SSL/TLS configuration scanner (documentation) | https://github.com/rbsec/sslscan - dnf - sslscan - 2.2.2-1.fc45: normalized package name match | Fedora Rawhide package metadata: sslscan from https://dl.fedoraproject.org/pub/fedora/linux/development/rawhide/Everything/x86_64/os/repodata/e5ca8ce900cd68f5419e1c39ae517343100b306336cbaeb70a3c153121d95094-primary.xml.zst | Security assessment tool for SSL/TLS | https://github.com/rbsec/sslscan/ - pacman - sslscan - 2.2.2-1: normalized package name match | Arch Linux sync databases: sslscan from https://geo.mirror.pkgbuild.com/extra/os/x86_64/extra.db.tar.gz | Fast tool to scan SSL services such as HTTPS to determine supported ciphers | https://github.com/rbsec/sslscan - zypper - sslscan - 2.2.2-1.1: normalized package name match | openSUSE Tumbleweed package metadata: sslscan from https://download.opensuse.org/tumbleweed/repo/oss/repodata/be8d3611d25469107f32075a1697e69ec57a2b850b42348a658cc671ad5ec2b50760d02c3e59524d50da9a11d5be799bdaffba2e166e8ca8858512e3c0bd665d-primary.xml.zst | SSL cipher scanning tool | https://github.com/rbsec/sslscan - MacPorts - sslscan: normalized package name match | MacPorts ports tree: net/sslscan/Portfile from https://api.github.com/repos/macports/macports-ports/git/trees/master?recursive=1 - Scoop - main/sslscan: normalized package name match | Scoop official bucket manifest trees: bucket/sslscan.json from https://api.github.com/repos/ScoopInstaller/Main/git/trees/master?recursive=1 ## Related links - [Source-control packages](https://www.automicvault.com/pkg/source-control-tools/) - Belongs to a source-control command family. - [Terminal utility packages](https://www.automicvault.com/pkg/terminal-utilities/) - Matched terminal and command-line workflow metadata. - [Networking and protocol packages](https://www.automicvault.com/pkg/networking-protocol-tools/) - Matched network, protocol, or remote-service metadata. - [Security and crypto packages](https://www.automicvault.com/pkg/security-crypto-tools/) - Matched security, identity, cryptography, password, signing, or certificate metadata. - [openssl@3](https://www.automicvault.com/pkg/brew/openssl-3/) - Runtime dependency declared by Homebrew. - [ssllabs-scan](https://www.automicvault.com/pkg/brew/ssllabs-scan/) - Shares av.db curated category or tags: cli, scanner, security, ssl, tls. - [libressl](https://www.automicvault.com/pkg/brew/libressl/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [sslsplit](https://www.automicvault.com/pkg/brew/sslsplit/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [certgraph](https://www.automicvault.com/pkg/brew/certgraph/) - Shares av.db curated category or tags: cli, security, tls. - [nss](https://www.automicvault.com/pkg/brew/nss/) - Shares av.db curated category or tags: cli, security, tls. - [gmssl](https://www.automicvault.com/pkg/brew/gmssl/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [gnutls](https://www.automicvault.com/pkg/brew/gnutls/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [mbedtls](https://www.automicvault.com/pkg/brew/mbedtls/) - Shares av.db curated category or tags: cli, security, ssl, tls. - [ike-scan](https://www.automicvault.com/pkg/brew/ike-scan/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, discover, openssl, openssl-3, scanner. - [tlsx](https://www.automicvault.com/pkg/brew/tlsx/) - Security-sensitive metadata or terminology overlaps. Shared terms: cli, scanner, security, ssl, tls. ## Combined YAML source View the package source record on GitHub. [combined/sslscan.yml](https://github.com/automic-vault/db/blob/main/combined/sslscan.yml) ## Sources - Nucleus package database - Geiger risk classifier - package-page enrichment - curated package history - package version freshness - av.db category and tag curation - package relationship graph - external package-manager database matches - cross-ecosystem install command graph