Skip to content


Switch branches/tags

Name already in use

A tag already exists with the provided branch name. Many Git commands accept both tag and branch names, so creating this branch may cause unexpected behavior. Are you sure you want to create this branch?

Latest commit


Git stats


Failed to load latest commit information.
Latest commit message
Commit time

TLS Prober

TLS Prober is a tool for identifying the implementation in use by SSL/TLS servers. It analyses the behaviour of a server by sending a range of probes then comparing the responses with a database of known signatures. Key features include:

  • Requires no knowledge of the server configuration.

  • Does not rely on the supported cipher suites (since administrators often change those).

  • Successfully identifies openssl, schannel, Java (JSSE), wolfSSL (previously CyaSSL), GnuTLS, MatrixSSL, mbedTLS (previously PolarSSL).

  • Supports both pure SSL/TLS protocols like HTTPS and those that use STARTTLS such as SMTP and POP3.

  • Reslient against differences in the build options used by a given server.

  • Extensible - you can easily record the signatures of additional implementations.


Clone the repository and the pytls submodule then run it!

git clone
cd tls_prober/ && git submodule update --init

TLS Prober requires python and has been tested using python 2.7, it is possible it may work with earlier versions too.

Note that the current implementation will not work on Windows since it makes use of the select() system call which is not available on that platform.

Basic Usage

Using TLS Prober is as easy as:


The output is a sorted list of matches with the best match first, for example the command above resulted in:

openssl-1.0.1h default source build     15
openssl-1.0.1h default source build (no-ec)     15
openssl-1.0.1g default source build     14
openssl-1.0.1g default source build (no-ec)     14

Common Options

The most commonly used option is -p which allows you to specify an alternative port (the default is 443). You can also use -s to select a STARTTLS mode, however generally the default mode of 'auto' will do the right thing.

TLS Prober supports operation over a socks proxy (for example the one provided by SSH). To use this feature you must set the socks_proxy environment variable, for example:

export socks_proxy=localhost:1080

Adding a Signature

Adding a new signature is easy, simply run TLS Prober like this:

./ -a 'ACME TLS version 1.0.0'

This will probe the server and add it to the fingerprint database. Please submit new fingerprints back so that they can be included in future releases.


For details of the implementation see the included paper in the doc directory.


TLS Prober was written by Richard Moore


Thanks to my colleagues at Westpoint for comments and suggestions, particularly Simon Ward. Thanks also to Daniel Molkentin and Peter Hartmann for providing feedback.


A tool to fingerprint SSL/TLS servers







No packages published