We Built a Free TLS Scanner (And Why We're Giving It Away)

We just shipped a free TLS scanner at krakenkey.io/scanner. No signup, no account, no email capture. Enter a hostname and get results in seconds.

What It Checks

The scanner performs a real TLS handshake against your endpoint and reports:

• Certificate details: subject, SANs, issuer, validity dates, key type and size, signature algorithm, fingerprint
• Chain validation: depth, completeness (is the root self-signed?), and system trust verification
• Connection metadata: TLS version, cipher suite, OCSP stapling status, handshake latency
• Overall health: a simple green/yellow/red assessment based on trust, expiry, and protocol version

It runs on the same open-source probe that powers KrakenKey’s paid monitoring product. The results you see in the free scanner are identical to what our monitoring probes report.

Why It’s Free

We need users. KrakenKey is a new platform and we’re building in public. A free scanner gets our probe into more hands and gives us a channel for feedback. If you use it and wish it also did X, we want to hear about it.

Continuous monitoring (alerts when certs expire, scans from multiple regions, historical trends) is what the paid product does. The scanner works on its own without any of that.

How It Compares to SSL Labs

SSL Labs by Qualys is the reference tool for TLS testing. Here is where we overlap and where we don’t.

What SSL Labs does that we don’t:

• Full protocol support matrix (which TLS versions are accepted, which are refused)
• Vulnerability scanning (BEAST, POODLE, Heartbleed, ROBOT, etc.)
• Cipher preference order analysis
• HSTS header detection and preload status
• Certificate Transparency log verification
• DNS CAA record checks
• Overall letter grade (A+ through F)

We’re not trying to replace SSL Labs.

Where we think we add value:

• Speed: our scan takes 2-5 seconds vs. 60-90 seconds for SSL Labs
• API access: the scanner is backed by a REST API, so you can curl it from CI or scripts
• Self-hostable: the probe is open source. Run it behind your firewall in standalone mode with no account, no rate limits, and no data leaving your network
• Same engine as monitoring: if you upgrade to paid monitoring, the results match exactly because it’s the same probe engine

We cover the most common failure modes: expired certs, broken chains, untrusted issuers, weak TLS versions. For most developers doing a quick “is my cert working?” check, that’s enough. For a full audit, use SSL Labs.

Self-Host the Probe

The scanner on our website calls a hosted instance of our probe. But you can run the same probe yourself:

docker run -d \
  -e KK_PROBE_MODE=standalone \
  -e KK_PROBE_ENDPOINTS=example.com:443,api.example.com:443 \
  -e KK_PROBE_INTERVAL=60m \
  ghcr.io/krakenkey/probe:latest

In standalone mode, the probe scans your configured endpoints on an interval and logs results locally. No API key, no account, no phone-home. Add it to your Docker Compose stack or run it as a systemd service.

The full source is at github.com/krakenkey/probe.

What We Want From You

This is v1 of the scanner. We want to know:

• What checks are missing that you’d expect?
• Is the result format useful? What would you change?
• Would you use an API endpoint for this in CI/CD?
• Would a CLI flag like krakenkey scan example.com be useful?

Email us at feedback@krakenkey.io or open an issue on GitHub. Feedback goes straight into what we build next.

Try the scanner now →