TLSAuditHub

Objective

TLSAuditHub is a lightweight platform for auditing SSL/TLS posture across services. It focuses on scheduled scans, change tracking, and an operator-friendly workflow.

The core TLS scanning engine is sslyze.

Vibe-Coded Project Note

This tool is vibe coded and community-driven. It is practical and fast-moving by design, and improvements are expected over time.

Requirements And Deployment (Simple)

Requirements

• Docker Engine
• Docker Compose
• Open ports 5173 (UI) and 8000 (API)

Quick Start In 60 Seconds

1. Create local environment file and adjust values:
   • cp .env-example .env
   • Edit .env (at minimum set a strong JWT_SECRET_KEY)
   • Example: head -c 48 /dev/urandom | base64 | tr -d '\n'
   • Alternative: openssl rand -hex 48
2. Start services:
   • docker compose up
3. Open UI:
   • http://localhost:5173
4. Log in with default admin account:
   • Username: Adm$n
   • Password: Cr!mson$Nebula_7#Qx

Security Notice

• Change the default admin password immediately after first login.
• Do not expose the stack publicly before changing credentials and hardening access.

Usage (Simple)

1. Add domains/hosts in Domains / Hosts.
2. Trigger scans (Run Scan) or wait for scheduler runs.
3. Review findings in Results, Certificates, and Reports.
4. Use Admin pages for auth/proxy/scheduler/SMTP/DKIM/check policies.

Troubleshooting

• UI looks stale after update:
  • hard refresh (Cmd+Shift+R on macOS, Ctrl+Shift+R on Windows/Linux).
• Services not healthy:
  • docker compose ps
  • docker compose logs ui api worker scheduler --tail=200
• Scan data missing:
  • verify target has TLS checks enabled.
  • verify worker is up.
• DNS/M365 details missing:
  • trigger DNS refresh (or wait for background collection).
  • check resolver/proxy/network reachability.
• Certificates list/details missing:
  • verify target has TLS checks enabled.
  • verify at least one completed TLS scan exists for that target.

Geeks-Nerds Section

Advanced topics and deployment variants live in dedicated docs pages:

• Deployment
• Authentication
• Security Policy
• DNS And DKIM
• Certificates
• Reports And SMTP

Recommended DKIM selector lists:

• docs/dkim-selectors-recommended.txt
• docs/dkim-selectors-recommended.csv

Disclaimer

TLSAuditHub is provided "as is", without warranties of any kind, express or implied, including (without limitation) warranties of merchantability, fitness for a particular purpose, and non-infringement.

The authors and contributors make no guarantee that scan results are complete, accurate, or suitable for operational, legal, compliance, or security decisions. Findings may include false positives and false negatives.

By using this software, you accept full responsibility for validating all outputs before acting on them and for any changes made in your environment.

To the maximum extent permitted by applicable law, the authors and contributors are not liable for any direct, indirect, incidental, special, consequential, or punitive damages, including but not limited to service interruption, data loss, security incidents, compliance failures, financial loss, or other damages arising from the use of, or inability to use, this tool.

Acknowledgments

• Kudos to the SSLyze maintainers for building and maintaining a robust TLS analysis tool that this project relies on.