Engineering Sep 27, 2026
Post-quantum TLS in Go: on by default, unless your go.mod says otherwise
Go 1.24+ negotiates X25519MLKEM768 by default, but an old go line in go.mod, CurvePreferences or TLS 1.2 turn it off. How to check and fix it.
Free TLS assessment
TLS Health & Agility
Get a clear report in minutes on your domain's TLS health and the risks worth fixing first. Test certificate expiry.
Scans public HTTPS endpoints and reports TLS posture in real time.
TLS scans in the wild
Real scans, anonymized. We refresh this snapshot about once an hour.
Loading chart...
How it works
SSLBoard connects to your infrastructure the same way the internet does. Your firewall stays as-is.
1
Enter a domain
Type company.com and hit scan. The summary report is free, no account required.
2
Every subdomain gets tested
SSLBoard pulls your subdomains from public certificate transparency logs and runs actual TLS connections against each one, across every IP, port, and protocol version it finds.
3
Get a scored, actionable report
A TLS score out of 100, findings ranked by severity and tied to specific hosts. Export to CSV or share the link. It's written so non-security people can follow it too.
What the report covers
Full TLS audit in minutes
Enter a domain and get a structured report covering certificates, protocol versions, cipher suites, forward secrecy, key strength, HSTS, and post-quantum readiness. No setup, no waiting.
Results you can act on
Every finding is ranked by severity and linked to the affected hosts. Export to CSV and pass it to whoever owns the fix.
See what attackers see
SSLBoard inspects discovered public endpoints from the outside, making live TLS connections and recording differences between addresses. No server credentials or software installation are needed.
Post-quantum readiness
Know which of your endpoints already negotiate hybrid key exchange and which ones still need work. PQC migration starts with knowing where you stand.
Scored and trackable
Each report gives you a weighted TLS score by category. Run it again after making changes to see whether it moved.
Readable without a security background
Every finding comes with a plain-language explanation. Large reports have a table of contents so nothing gets buried. Share the link with whoever needs to see it.
Latest from the blog
Engineering Sep 27, 2026
Post-quantum TLS in Node.js: which versions do it and how to check
Node.js 22.20+ and 24.5+ negotiate X25519MLKEM768 by default. Which versions do it, how to verify it, and the ecdhCurve setting that turns it off.
Engineering Sep 27, 2026
x509: certificate signed by unknown authority in Go: the four causes and how to fix each
Go says x509: certificate signed by unknown authority but your browser works? The four causes, how to tell them apart, and the right fix for each.