Skip to main content

TLS and subdomain audit

The subdomain and TLS audit you can hand to an auditor

SSLBoard finds your subdomains in Certificate Transparency logs, connects to every one of them, and reports certificate, protocol, cipher and post-quantum issues in the order you should fix them.

The summary report is free and needs no account. It is ready in a few minutes.

Sample report · airbus.com

What one scan found on airbus.com

We pointed SSLBoard at airbus.com with nothing but the domain name. The 45-page PDF opens with a remediation plan of 20 numbered actions, then lays out the evidence behind each of them.

Hostnames
1,393
hostnames found in Certificate Transparency logs
Deprecated protocols
540
endpoints still accept SSLv3, TLS 1.0 or TLS 1.1
Expired certificates
5
expired certificates still being served
DNSSEC
697
hostnames in zones without DNSSEC
Download the PDF Walk through the report

Airbus is not an SSLBoard customer and did not request this report. Every result comes from public DNS, Certificate Transparency logs and ordinary TLS connections.

Page 3 of the airbus.com sample report: Fix now, with what to change

p.03 Fix now, with what to change

Page 10 of the airbus.com sample report: How the scan compares

p.10 How the scan compares

Page 12 of the airbus.com sample report: Evidence per protocol

p.12 Evidence per protocol

Every dot is a real scan

Completed SSLBoard scans, anonymized and placed by size and score. Large estates tend to score lower, and your report tells you where you sit among scans of a similar size.

Loading chart...

How it works

SSLBoard connects to your services the same way any visitor does, so there is nothing to install and your firewall stays as it is.

  1. 01

    Enter a domain

    Type company.com and start the scan. The summary report is free and needs no account.

  2. 02

    Every subdomain gets tested

    Hostnames come from Certificate Transparency logs. Each one gets real TLS connections on every IP, port and protocol version found.

  3. 03

    Fix in priority order

    You get a score out of 100 and a numbered plan tied to specific hosts. Retest after the fixes to confirm them.

What the report covers

01
Finds the subdomains you forgot
Every certificate ever issued for your domain is public in Certificate Transparency logs. SSLBoard reads them, so forgotten hosts show up in the report next to the ones you know about.
02
Tests every endpoint from the outside
Each hostname is resolved and every IP and port gets a live TLS connection. Protocol versions, cipher suites, forward secrecy and key strength are recorded per endpoint, with no agent and no credentials.
03
A remediation plan in priority order
Findings are grouped into fix now, fix soon and worth reviewing. Each numbered item says what to change, how to verify it, and links to the evidence and a CSV of affected hosts.
04
Post-quantum readiness
See which endpoints already negotiate hybrid ML-KEM key exchange and which ones still need work, so the PQC migration starts from an inventory instead of a guess.
05
Certificates, DNSSEC, headers and mail
Expiry and renewal risk, issuers and CAA, DNSSEC per zone, HSTS and security headers, and STARTTLS on the mail servers behind your MX records.
06
A report you can hand over
A PDF for auditors and clients, a shareable link for your team, and a score out of 100 compared with scans of a similar size. Retest after the fixes to show the score moved.

Pricing

Every scan is free. Pay once for the full report when you need the host-level detail to fix things. There is no subscription.

Summary report

Free

for every scan

  • ✓TLS score out of 100 and how it compares
  • ✓Every finding, ranked by priority
  • ✓Hostname and endpoint counts
  • ✓Shareable link, no account needed
Scan a domain

Full report

$9

Small sites

up to 15 endpoints

$49

Larger estates

16 endpoints or more

Paid once per scan. The free scan counts your endpoints and shows which price applies before you pay.

  • ✓PDF report with a numbered remediation plan
  • ✓Every affected host, IP and port
  • ✓Certificate inventory and CSV, Markdown and JSON exports
  • ✓30 days of free retests to confirm the fixes
See a full report

From the blog

All articles