SSL Labs, TLS/SSL Deep Analysis

Qualys SSL Labs performs a comprehensive TLS/SSL scan and assigns a grade from A+ to F. It checks cipher suite strength, certificate validity and chain, protocol support (TLS 1.0, 1.3), forward secrecy, and known vulnerabilities like Heartbleed, POODLE, DROWN, and LOGJAM.

No API key required. Scans can take 60, 120 seconds for first-time analysis.

When to Use

• Verify TLS configuration before or after a certificate renewal
• Compliance check: confirm TLS 1.0/1.1 is disabled, HSTS is set
• Incident response: check if a server is vulnerable to Heartbleed or POODLE
• User asks "what grade is my SSL?", "is the TLS cert on X valid?", "does site support TLS 1.3?"

How to Use

Start a scan and poll for results

$host   = "github.com"
$apiUrl = "https://api.ssllabs.com/api/v3/analyze"

# Start new scan
$result = Invoke-RestMethod -Uri "$apiUrl`?host=$host&publish=off&startNew=on&all=done"
Write-Host "Status: $($result.status)"

# Poll until ready (may take 1-2 minutes)
while ($result.status -ne 'READY' -and $result.status -ne 'ERROR') {
    Start-Sleep -Seconds 20
    $result = Invoke-RestMethod -Uri "$apiUrl`?host=$host&publish=off&all=done"
    Write-Host "Status: $($result.status), $(($result.endpoints | Measure-Object).Count) endpoint(s)"
}

$result.endpoints | ForEach-Object {
    Write-Host "  $($_.ipAddress)  Grade: $($_.grade)  $($_.statusMessage)"
}

Check TLS protocols and known vulnerabilities

$host   = "example.com"
$result = Invoke-RestMethod -Uri "https://api.ssllabs.com/api/v3/analyze?host=$host&publish=off&all=done"

while ($result.status -ne 'READY') {
    Start-Sleep -Seconds 15
    $result = Invoke-RestMethod -Uri "https://api.ssllabs.com/api/v3/analyze?host=$host&publish=off&all=done"
}