# SSLBoard > Agentless, on-demand TLS audits. Type a domain and get a report in minutes. No agents and no account required. SSLBoard uses Certificate Transparency data plus active endpoint scanning to inventory deployed certificates and evaluate TLS posture across your public infrastructure. ## Who it's for - **Security and infrastructure teams** that need fast visibility into certificate and TLS risk. - **Compliance-focused teams** preparing evidence for audits such as PCI DSS and SOC 2. - **Organizations of any size** that need a clear, shareable TLS report without a long setup process. ## Key capabilities - **Domain-wide discovery**: finds hostnames and TLS endpoints, then verifies live deployment with real handshakes. - **TLS audit coverage**: certificates, deprecated protocol versions, weak ciphers, forward secrecy, key strength, web hardening, DNSSEC/CAA signals, and post-quantum readiness. - **Scored findings**: weighted TLS score with prioritized issues and affected hosts/endpoints. - **Actionable output**: summary and full report views, shareable report links, plus CSV, Markdown, and JSON exports. ## What makes it different - **Discovery plus deployment verification in one workflow**. - **CA-agnostic** support for publicly trusted certificates across issuers. - **Fully agentless** external scanning with no software install on your servers. ## Pricing - **Scanning is free**: every scan shows the score, the executive summary, and the key findings, with no account or email. - **Full report**: $5 for 10 endpoints or fewer, $20 above, paid once through Stripe. It adds every affected host and endpoint, the certificate inventory, and CSV, Markdown, and JSON exports, and includes 30 days of free retests. - Reports older than 24 hours are stale: their details come with a fresh scan at the same price. - Entering the same domain again reuses the latest completed report when stored report data is available. ## Important notes - Wildcard certificates and non-standard ports may require manually adding hostnames or ports because SSLBoard cannot infer wildcard subdomains automatically. - SSLBoard is **not** an uptime monitor. It audits TLS/SSL configuration and certificate health. ## Documentation Every check SSLBoard runs has a page explaining what it observed, what the result does and does not establish, and the change that clears it. ### Getting started - [Your first SSLBoard scan](https://sslboard.com/docs/getting-started/): Type a domain, wait about a minute, and get an inventory of every public host SSLBoard could find and what each one is serving. No agent, no credentials. - [How SSLBoard gets its data](https://sslboard.com/docs/how-scanning-works/): Certificate Transparency logs suggest names, DNS resolves them, and live connections decide the facts. Knowing the source tells you how much to trust a row. - [Why a subdomain is missing from a scan](https://sslboard.com/docs/scan-coverage/): Why a live host can be missing, why a dead one keeps showing up, and the four things an external scan structurally cannot see. ### Common problems - [SSL certificate renewed but still showing expired](https://sslboard.com/docs/certificate-renewed-still-expired/): The certificate on disk is new and the browser still sees the old one. Six places the stale certificate is hiding, in the order worth checking. - [Certificate name does not match the hostname](https://sslboard.com/docs/certificate-name-mismatch/): ERR_CERT_COMMON_NAME_INVALID means the certificate is valid, just not for the name you asked for. Five reasons that happens and how to read the SAN list. - [I set the HSTS header but it is not there](https://sslboard.com/docs/hsts-header-missing/): Response headers pass through a chain and only the last writer wins. How to find which layer is dropping or overwriting Strict-Transport-Security. - [IPv6 serves a different certificate than IPv4](https://sslboard.com/docs/ipv6-different-certificate/): Same hostname, two addresses, two machines. Why half your visitors can hit a broken certificate while every test you run says the site is fine. - [Port 25, 465, or 587: which one is actually broken?](https://sslboard.com/docs/smtp-ports-25-465-587/): Receiving mail and sending mail use different ports, different encryption, and fail independently. A closed submission port does not stop inbound delivery. - [TLS 1.3 is enabled but TLS 1.0 is still flagged](https://sslboard.com/docs/tls13-enabled-tls10-still-on/): Enabling a new protocol version does not disable the old ones. Your server offers a list, and the client picks from it. - [Does an RSA certificate mean no forward secrecy?](https://sslboard.com/docs/rsa-certificate-forward-secrecy/): No. The certificate authenticates the server, the key exchange protects the session, and they are chosen independently. RSA key exchange is the thing to remove. - [Why is a domain I do not own on my certificate?](https://sslboard.com/docs/unknown-domain-on-my-certificate/): Usually because a shared hosting platform bundled you onto one certificate with other customers. Here is when that is normal and when it is worth a question. - [My zone is enumerable: is NSEC3 the fix?](https://sslboard.com/docs/dnssec-zone-enumeration/): Not entirely. NSEC3 raises the cost of walking your zone rather than preventing it, and the parameters most people pick make it worse. How to decide. ### Understanding results - [Reading your report](https://sslboard.com/docs/reading-your-report/): Hostnames, endpoints, and certificates count different things. Mixing them up is the fastest way to send the wrong ticket to the wrong team. - [What a blank or unknown scan result means](https://sslboard.com/docs/result-states/): A check that could not run looks a lot like a check that passed. Here is how to tell the difference before you report a domain as clean. - [What is a good TLS score?](https://sslboard.com/docs/tls-score/): Seven weighted categories, a penalty curve that cares about proportion as much as count, and a list of things the number deliberately ignores. ### Checks - [Certificate expiry, revocation, and deployment](https://sslboard.com/docs/certificates/): Renewing a certificate and deploying it are two different jobs, and only one of them shows up in your report. Here is how to tell which one you have done. - [How to read a CAA record](https://sslboard.com/docs/caa/): A CAA record tells certificate authorities who may issue for you. An empty wildcard column does not mean wildcards are banned, which trips up most people. - [TLS versions and deprecated protocols](https://sslboard.com/docs/tls-versions/): Supporting TLS 1.3 does not switch off TLS 1.0. Both can be reachable on the same endpoint, and an attacker gets to pick. - [What each OCSP stapling result means](https://sslboard.com/docs/ocsp-stapling/): Stapling attaches a freshness proof to your handshake. Eight results are possible, and No response means something very different from Revoked. - [Weak and legacy cipher suites](https://sslboard.com/docs/weak-ciphers/): Which cipher families SSLBoard flags and why, plus the reason family counts never add up to endpoint counts. - [Forward secrecy](https://sslboard.com/docs/forward-secrecy/): Forward secrecy decides whether traffic recorded today stays private if your key leaks in five years. Five classifications, and one of them is a trap. - [What certificate key size should you use?](https://sslboard.com/docs/key-analysis/): What Recommended, Legacy, Too Small, Unknown, and RSA-only mean, and why a certificate key tells you nothing about key exchange. - [HTTP to HTTPS redirects](https://sslboard.com/docs/https-redirects/): Your HTTPS site can be flawless and still serve plain HTTP on port 80 to anyone who asks. That first unencrypted request is the finding. - [HSTS and HTTPS browser policy](https://sslboard.com/docs/hsts/): HSTS is the one header with a delete key that is hard to reach. Get max-age, includeSubDomains, and preload right before you ship it, not after. - [Browser security headers and cookies](https://sslboard.com/docs/security-headers/): CSP, frame protection, nosniff, and eight cookie findings. All of them need your application's context before you tighten anything. - [Connection and certificate errors](https://sslboard.com/docs/connection-errors/): Six error categories, what each one narrows the problem down to, and why a failed connection is never evidence about your certificate. - [Post-quantum TLS readiness](https://sslboard.com/docs/post-quantum/): Harvest now, decrypt later is the threat this addresses. Hybrid key exchange is available today, and the check tells you which endpoints already negotiate it. - [DNSSEC validation and zone findings](https://sslboard.com/docs/dnssec/): Unsigned, broken, and enumerable are three different DNSSEC problems with three different responses. Bogus is the one that takes your domain offline. - [How to check if your mail server uses TLS](https://sslboard.com/docs/email-transport/): Port 25 receives mail from the world, 465 and 587 take it from your users. They fail independently, and confusing them sends the wrong ticket. - [SPF, DMARC, MTA-STS, TLS-RPT, and DANE](https://sslboard.com/docs/email-policies/): Five published policies that decide whether anyone can send mail as you. Having a record and enforcing one are very different states. - [Adjacent domains and certificate relationships](https://sslboard.com/docs/adjacent-domains/): Another company's domain in your report usually means you share a certificate with them. Worth knowing, and not the same as sharing an owner. ### Using reports - [Report access, sharing, and exports](https://sslboard.com/docs/sharing-and-exports/): The full-report link carries its own access. Forwarding it forwards the access, so decide who needs the whole report before you paste it anywhere. - [Fixing findings and verifying changes](https://sslboard.com/docs/fixing-and-retesting/): A good ticket names the endpoint, the owner, and what success looks like. Then you prove it with a scan that ran after the deployment, not before. ## Links - Website: https://sslboard.com/ - FAQ: https://sslboard.com/faq/ - Blog: https://sslboard.com/blog/ ## Company Developed by [Gone Coding Ltd.](https://gone-coding.com) — Unit 1603, The L. Plaza, 367–375 Queen's Road Central, Sheung Wan, Hong Kong.