Local TLS security scan - grade internal servers A+ to F
Run a private TLS scan from your own machine: protocol versions, cipher suites, certificate and HTTP security headers, graded A+ to F like the aethercert.com scanner.
The Security scan grades one TLS endpoint from A+ to F: which TLS versions it accepts, which cipher suites, whether its certificate is valid and trusted, and which HTTP security headers it sends. It is the aethercert.com Security Scan run from your machine - the same rubric and finding codes, with the two scoring differences listed below (HSTS, certificate signature) - so it works for what the public scanner cannot reach: internal host names, private IP addresses, any port, and services other than HTTPS. It is a private TLS scan: the result stays on your computer.
On the command line it is actk security. From
the Certificate scanner, Run security scan
opens an endpoint here.
Run a scan
| Field | What to enter |
|---|---|
| Host or URL | intranet.corp.local, 10.0.0.25 or https://portal.corp.local:8443/login |
| Port | 443 unless the URL says otherwise |
| Server name (SNI) | Optional. The name to request and check the certificate against when the target is an IP address. |
| Protocol | Automatic (by port), or TLS, SMTP STARTTLS, IMAP STARTTLS, POP3 STLS, FTP AUTH TLS, RDP |
| Checks | TLS & certificate and HTTP security headers - untick one to skip it |
Scan connects, reads the certificate, tests the protocol versions and cipher suites, checks the HTTP headers and grades the result. A scan of one endpoint takes seconds.
Read the result
The summary shows the overall grade, the score out of 100 and the scan time. Tabs hold the detail: Overview, TLS, Certificate, HTTP headers and Raw result (the JSON that Export JSON … writes).
Findings are sorted by weight - confirmed weakness, then warning, then not verified - and each one comes with what to do about it, for example:
| Finding | Remediation |
|---|---|
| The server still accepts TLS 1.0 and/or TLS 1.1 | Disable TLS 1.0 and 1.1 (Windows: SCHANNEL registry or IIS Crypto; nginx: ssl_protocols TLSv1.2 TLSv1.3). |
| The chain is not trusted by common trust stores | Make the server send the intermediate certificates (full chain); for an internal CA, deploy its root to the clients. |
| The certificate does not cover the scanned host name | Issue a certificate that names this host as a SAN, or connect with a name the certificate covers. |
| The server accepts insecure cipher suites | Disable the listed suites (RC4, 3DES, NULL, EXPORT) on the server. |
| No Strict-Transport-Security header | Send Strict-Transport-Security: max-age=31536000. |
A protocol result is verified, unknown (the probe did not finish - a firewall or IPS interrupting handshakes is the usual reason) or not tested. An unknown result is listed as a finding to check, but costs no points: a probe that did not finish is no evidence of a weakness.
How the grade is calculated
Each category starts at 100 points. Findings deduct points, and serious ones also cap the score, so one severe problem cannot be outweighed by good marks elsewhere.
| Grade | Score |
|---|---|
| A+ | 97-100 |
| A | 90-96 |
| A- | 80-89 |
| B | 70-79 |
| C | 55-69 |
| D | 40-54 |
| F | below 40 |
| Finding | Caps the TLS grade at |
|---|---|
| Certificate expired, or host name not covered | F |
| Neither TLS 1.2 nor TLS 1.3 supported | F |
| Insecure cipher suites, or an RSA key below 2048 bits | D |
| Self-signed or untrusted chain, or a SHA-1/MD5 certificate signature | C |
| TLS 1.0 or 1.1 accepted | B |
The overall score weights TLS and certificate 3 to HTTP headers 2.
TLS 1.0 and 1.1 and weak cipher suites are probed with a hand-built ClientHello: the server's reply answers the question, and no key exchange ever takes place.
Differences from the aethercert.com Security Scan
| aethercert.com | Toolkit | |
|---|---|---|
| Runs from | aethercert's servers, over the internet | Your computer, inside your network |
| Targets | Public host names | Any host, IP address and port |
| Services | HTTPS and mail | HTTPS, LDAPS, RDP, SMTP/IMAP/POP3 STARTTLS, FTP, any TLS port |
| HSTS | Always scored | Only scored on services that answer HTTP - LDAPS or RDP cannot send it |
| Certificate signature | Not read | A SHA-1 or MD5 signature is a finding |
| Result | A report page on aethercert.com | Only on your screen, and in the JSON you export |
Export
Export JSON … writes the result in the aethercert.toolkit.security-scan/v1 format,
field-compatible with the public scanner's results - see Reports.