TLS security scan for internal hosts
The aethercert Security Scan, run from your own computer: TLS 1.0 to 1.3, cipher suites, the certificate and HTTP security headers, graded A+ to F - for intranet hosts, private IP addresses and any port a public scanner cannot reach.
Version 1.1.2 · 27 October 2026 · Windows x64 · free · Download the aethercert Toolkit
The same rubric, from inside the network
The public Security Scan on aethercert.com tests hosts on the internet. The Toolkit's security scan grades with the same rubric - the same codes, thresholds and caps - from inside your network, so an internal portal, an LDAPS endpoint or a management interface gets a grade too.
Two deliberate differences: HSTS is only scored on services that answer HTTP, since LDAPS or RDP cannot send it, and a certificate signed with SHA-1 or MD5 is a finding. Every finding comes with remediation advice, sorted from confirmed weakness to warning to not verified.
What a private TLS scan checks
- 01
Enter the endpoint
A host, host:port or URL - or an IP address with the name to check the certificate against.
- 02
Probe protocols and ciphers
TLS 1.0 and 1.1, RC4, 3DES and CBC are tested with a hand-built ClientHello: the server's answer is the result, no key exchange happens.
- 03
Check certificate and headers
Chain, names, validity, key and signature algorithm, and the HTTP security headers where the service speaks HTTP.
- 04
Read the grade
A+ to F with each finding and what to change, as tabs for overview, TLS, certificate, headers and the raw JSON.
What the security scan reports
TLS 1.0 to 1.3
Each version marked verified, unknown when a probe failed, or not tested.
Cipher suites
Weak suites such as RC4, 3DES and CBC are detected on the wire, including on servers too old for a modern client.
Certificate
Trust against Mozilla roots, the Windows store and an optional internal root, name match, expiry, key size and signature algorithm.
HTTP security headers
HSTS and the other security headers, scored only where the service answers HTTP.
Mail and Remote Desktop
STARTTLS for SMTP, IMAP, POP3 and FTP is detected from the port; RDP is negotiated too.
Remediation advice
What to change for every finding - for SCHANNEL and IIS as well as nginx - and a JSON report to keep.
Grade endpoints from a script
actk security grades one endpoint and writes the report as JSON - field-compatible with the public scanner's results.
actk security intranet.corp.local:8443 --json report.jsonactk security 10.0.0.25:25actk security 10.0.0.40 --port 636 --sni dc01.corp.local --ca-file corp-root.pemMore tools in the Toolkit
Documentation
Frequently asked questions
TLS security scan
How does it differ from the online Security Scan?
It uses the same grading but runs on your computer, so it reaches internal host names, private IP addresses and any port. HSTS only counts where the service speaks HTTP, and SHA-1 or MD5 certificate signatures are findings.
Can I scan a host by IP address?
Yes. Give the IP address and, with --sni in actk or the name field in the app, the host name the certificate should match.
Does the scan change anything on the server?
No. It opens connections, reads the server's handshake answers and HTTP response headers; it never changes a setting or logs in.
Is an internal CA trusted?
Yes, if it is in the Windows store - including an enterprise CA from group policy - or if you pass its root with --ca-file.
Fixed the TLS settings - what about the certificates?
aethercert keeps the certificates on those hosts current: renewed before they expire and installed into the service that uses them.
Community plan, no card required. Open registration - your account is ready in a few minutes.