tlsprobe

Modern TLS inspection tool written in pure Rust using rustls.

tlsprobe is a simple command-line tool to inspect TLS connections. It connects to a target host, performs a TLS handshake using rustls (no OpenSSL), and displays useful information about the connection and certificate.

---

Features

• Shows negotiated TLS version and cipher suite
• Displays certificate details:
  • Subject & Issuer
  • Validity period (with days remaining)
  • Subject Alternative Names (SANs)
  • SHA-256 fingerprint
• Support for full certificate chain (--chain)
• Insecure mode for testing self-signed / invalid certificates (--insecure)
• Clean and colored terminal output
• Built with modern and memory-safe Rust ecosystem

---

Requirements

• Rust 1.75 or newer (recommended: latest stable)
• Internet connection (to connect to target hosts)

---

Installation

1. Clone the repository

git clone https://github.com/USERNAME/tlsprobe.git
cd tlsprobe

2. Build

cargo build --release

Binary akan tersedia di:

./target/release/tlsprobe

3. (Optional) Install to system

cargo install --path .

---

Usage

Basic usage

tlsprobe google.com
tlsprobe github.com
tlsprobe example.com:443

Show full certificate chain

tlsprobe google.com --chain

Skip certificate verification (for testing only)

tlsprobe self-signed.badssl.com --insecure

Set custom timeout

tlsprobe example.com --timeout 5

Available options

tlsprobe [OPTIONS] <HOST>

Arguments:
  <HOST>  Target host (e.g. example.com or example.com:443)

Options:
  -p, --port <PORT>        Port (default: 443)
      --insecure           Skip certificate verification (INSECURE)
  -c, --chain              Show full certificate chain
  -t, --timeout <TIMEOUT>  Timeout in seconds (default: 10)
  -h, --help               Print help
  -V, --version            Print version

---

Example Output

══════════════════════════════════════════════════════════════
 TLS Probe   → google.com:443
══════════════════════════════════════════════════════════════

→ Connecting to google.com:443 ...
✓ TCP connected
✓ TLS handshake successful

TLS Version:           TLSv1_3
Cipher Suite:          TLS13_AES_256_GCM_SHA384

── Certificate Information ──

Subject:               CN=*.google.com
Issuer:                C=US, O=Google Trust Services, CN=WR2
Serial:                ...
Not Before:            2026-08-05 ...
Not After:             2026-10-28 ...  (63 days left)
Public Key:            ...
Signature:             ...
SANs:
  • DNS:*.google.com
  • DNS:*.youtube.com
  • ...
SHA-256 Fingerprint:   04:a2:fd:09:...

(+ 2 intermediate certificates hidden. Use --chain to show all)

══════════════════════════════════════════════════════════════
Done.

---

Tech Stack

Component	Crate
TLS	rustls + tokio-rustls
Async Runtime	tokio
CLI	clap
Certificate	x509-parser
Crypto	ring (via rustls)
Output	colored

---

Advantages

• Memory safe — written in Rust, no buffer overflows
• No OpenSSL dependency — uses pure Rust rustls
• Modern defaults — only supports strong TLS versions and ciphers
• Simple & focused — does one thing well
• Good for learning — clean example of how to use rustls correctly
• Fast — written in Rust + async

---

Limitations / Weaknesses

• Currently only supports TCP + TLS (no STARTTLS, DTLS, etc.)
• Does not perform deep vulnerability scanning (unlike testssl.sh or sslyze)
• No support for client certificates (mTLS) yet
• No JSON / machine-readable output yet
• Certificate transparency / OCSP checking not implemented
• Only shows basic certificate information

---

Roadmap (Ideas)

• JSON output (--json)
• Scan multiple hosts
• Export certificate to PEM file
• Detect weak configurations
• Support for client certificates
• HTTP response status (optional)

## License

This project is licensed under the **MIT License** (or dual MIT/Apache-2.0).

Author

[Khairunnisya Lubis]

Built as a learning project to explore Rust and rustls in the context of network security.

Feel free to open issues or pull requests!