How to Install and Use tlsx in Linux for Fast TLS and SSL Data Collection

Auditing Transport Layer Security (TLS) across hundreds or thousands of networked endpoints is an essential task for security engineers, DevOps specialists, and penetration testers. Traditional tools such as OpenSSL s_client process targets sequentially and generate verbose output, creating significant latency during large-scale network assessments. tlsx, developed by ProjectDiscovery, is a modular, high-speed Go-based utility engineered to perform rapid TLS handshakes, extract SAN extensions, audit cipher suites, and validate certificate chains at scale.

Installation Methods

Deploy tlsx across modern Linux distributions using precompiled binaries or Go toolchains:

Step-by-Step Practical Usage

1. Single Host Certificate Inspection: Probe a domain on default HTTPS port 443 to retrieve basic Subject Alternative Names (SAN) and issuer details:

   tlsx -u example.com -san -cn

2. High-Speed Multi-Host Probing from Standard Input: Feed a list of discovered hostnames or IP addresses from reconnaissance tools directly into tlsx:

   cat subdomains.txt | tlsx -ports 443,8443,9443 -c 100 -o live_tls_hosts.txt

   The -c 100 switch establishes 100 concurrent worker threads, resolving and validating thousands of endpoints in seconds.
3. Extracting Expiry Dates and Wildcard Mismatches: Check certificate validity periods to identify expiring or improperly bound certificates:

   tlsx -u example.com -ex -expired -self-signed

   This reveals whether the target serves a valid commercial certificate or an unverified self-signed fallback.
4. Auditing Supported TLS Protocol Versions: Enforce regulatory compliance by verifying that servers do not negotiate obsolete protocols (TLS 1.0 or TLS 1.1):

   tlsx -u example.com -version

   To probe specifically for legacy cipher acceptance:

   tlsx -u example.com -tls10 -tls11

5. Structured JSON Output for Security Pipelines: Stream raw machine-readable JSON payloads containing serial numbers, SHA-256 fingerprint hashes, and cryptographic signatures into jq:

   tlsx -u example.com -json | jq '{subject: .subject_dn, issuer: .issuer_dn, expires: .not_after}'

Advanced Capabilities: JARM and JA3 Fingerprinting

To detect malicious infrastructure, backend reverse proxies, or hidden command-and-control servers, tlsx generates active JARM signatures:

tlsx -u example.com -jarm

JARM crafts ten distinct TLS client hellos to fingerprint the remote TLS stack implementation, enabling security teams to correlate separate IP addresses running identical web servers or load balancers regardless of domain masking.