TLSleuth is an open-source PowerShell module for inspecting TLS endpoints and certificate details from scripts or the command line.

It provides clean, structured, script-friendly output for operators, engineers, and automation pipelines that need reliable TLS insight.

Features

New Feature: RDP Certificate Inspection

TLSleuth can retrieve the TLS certificate presented by an RDP server. Because RDP does not start TLS immediately after opening a TCP connection, the RdpTls transport performs RDP security negotiation before starting the TLS handshake.

Get-TLSleuthCertificate -Hostname rdp.example.com -Port 3389 -Transport RdpTls

On the standard RDP port, TLSleuth can infer RdpTls, so the transport can be omitted:

Get-TLSleuthCertificate -Hostname rdp.example.com -Port 3389

The same transport is available to Test-TLSleuthProtocol. RDP Network Level Authentication (NLA) remains a separate authentication step; TLSleuth inspects the certificate and TLS session but does not perform user authentication.

Read Retrieving TLS Certificates from RDP Servers with TLSleuth for usage, implementation details, and troubleshooting guidance.

New Feature for Version 2 - Explicit Transport Support

Supported -Transport values:

The -Transport parameter accepts ImplicitTls, SmtpStartTls, ImapStartTls, Pop3StartTls, and RdpTls. You can retrieve certificates from SMTP, IMAP, and POP3 servers using STARTTLS/STLS negotiation, or from RDP servers after RDP security negotiation, rather than assuming every service starts TLS immediately.

This allows TLSleuth to:

For more information see this page: Implicit vs Explicit TLS

New Feature for Version 2.3 - Testing Supported TLS Protocols

New Command: Test-TLSleuthProtocol

TLSleuth now includes Test-TLSleuthProtocol, a command designed to quickly evaluate which TLS protocol versions successfully negotiate with a remote endpoint. The command iterates through all TLS protocol versions available in the current runtime (Ssl3, Tls, Tls11, Tls12, Tls13 where supported) and performs an independent connection and handshake attempt for each. Results are returned as structured objects showing whether the connection succeeded, along with negotiated session details such as protocol version, cipher suite, and forward secrecy status when available.

This makes it easier to verify protocol support across servers without manually running multiple tests.

For a deeper explanation of how the command works and examples of how to use it, see the full article: Testing Supported TLS Protocols with TLSleuth

Limitations and When to Use a Dedicated TLS Scanner

TLSleuth is designed for practical, scriptable TLS inspection - retrieving the negotiated certificate, protocol, and cipher from PowerShell.

Because it relies on .NET SslStream and the underlying OS TLS stack (SChannel on Windows), it has intentional limitations:

For full TLS posture analysis, cipher enumeration, downgrade testing, and vulnerability scanning, use a Dedicated TLS Scanner

Installation and Updating

Install-Module TLSleuth -Scope CurrentUser
Import-Module TLSleuth

Update-Module TLSleuth

Recommended: PowerShell 7+ Supported: Windows PowerShell 5.1 (reduced TLS/cipher detail)

Quick Start

# Fetch certificate + handshake details
Get-TLSleuthCertificate -Hostname github.com

# Constrain protocol
Get-TLSleuthCertificate -Hostname google.com -TlsProtocols Tls12

# Pipeline usage
'github.com','microsoft.com' |
  Get-TLSleuthCertificate |
  Select Hostname, NegotiatedProtocol, CipherAlgorithm, CipherStrength, NotAfter

# Verbose tracing
Get-TLSleuthCertificate -Hostname microsoft.com -Verbose

# New in V2.0.0 - Retrieve certificate from SMTP server
Get-TLSleuthCertificate -Hostname smtp.gmail.com -port 25 -Transport SmtpStartTls

# New in V2.1.0 - Retrieve certificate from IMAP server
Get-TLSleuthCertificate -Hostname outlook.office365.com -Port 143 -Transport ImapStartTls

# New in V2.1.0 - Retrieve certificate from POP3 server
Get-TLSleuthCertificate -Hostname pop.gmail.com -Port 110 -Transport Pop3StartTls

# Retrieve a certificate from an RDP server
Get-TLSleuthCertificate -Hostname rdp.example.com -Port 3389 -Transport RdpTls

# New in V2.3.0 - Test protocol support on an HTTPS endpoint
Test-TLSleuthProtocol -Hostname github.com |
  Select Protocol, ConnectionSuccessful, NegotiatedProtocol, NegotiatedCipherSuite, ErrorMessage

# New in V2.3.0 - Test protocol support for SMTP STARTTLS
Test-TLSleuthProtocol -Hostname smtp.gmail.com -Port 587 -Transport SmtpStartTls |
  Select Protocol, ConnectionSuccessful, NegotiatedProtocol, ErrorMessage

# New in V2.3.0 - Pipeline protocol testing across multiple hosts
'github.com','microsoft.com' |
  Test-TLSleuthProtocol |
  Where-Object ConnectionSuccessful |
  Select Hostname, Protocol, NegotiatedProtocol, NegotiatedCipherSuite

# Retrieve an invalid certificate but keep validation diagnostics
Get-TLSleuthCertificate -Hostname wrong.host.badssl.com -SkipCertificateValidation |
  Select Hostname, CertificateValidationPassed, CertificatePolicyErrors, CertificatePolicyErrorFlags

When connecting by IP but requiring proper SNI, use -TargetHost example.com.

Output Model

Get-TLSleuthCertificate

Example:

Get-TlsleuthCertificate -Hostname github.com

PSTypeName                  : TLSleuth.CertificateResult
Hostname                    : github.com
Port                        : 443
TargetHost                  : github.com
Subject                     : CN=github.com
Issuer                      : CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, C=GB
Thumbprint                  : 0123456789ABCDEF0123456789ABCDEF01234567
SerialNumber                : 0ABC1234DEF56789ABC1234DEF56789A
NotBefore                   : 02/01/2026 12:00:00 AM
NotAfter                    : 01/04/2026 11:59:59 PM
IsValidNow                  : True
DaysUntilExpiry             : 25
CertificateValidationPassed : True
CertificatePolicyErrors     : None
CertificatePolicyErrorFlags : {}
CertificateChainStatus      : {}
NegotiatedProtocol          : Tls13
CipherAlgorithm             : Aes256
CipherStrength              : 256
NegotiatedCipherSuite       : TLS_AES_256_GCM_SHA384
HashAlgorithm               : Sha384
HashStrength                : 384
KeyExchangeAlgorithm        : None
KeyExchangeStrength         : 0
IsMutuallyAuthenticated     : False
IsEncrypted                 : True
IsSigned                    : True
NegotiatedApplicationProtocol : h2
ForwardSecrecy              : True
ElapsedMs                   : 48
Certificate                 : X509Certificate2

Properties include:

NegotiatedCipherSuite and NegotiatedApplicationProtocol depend on runtime/OS support and may be $null on Windows PowerShell 5.1.

Test-TLSleuthProtocol

Test-TLSleuthProtocol returns one TLSleuth.ProtocolTestResult object per protocol attempt.

Example output (one successful protocol attempt and one failed attempt):

Test-TLSleuthProtocol -Hostname github.com

PSTypeName                    : TLSleuth.ProtocolTestResult
Hostname                      : github.com
Port                          : 443
TargetHost                    : github.com
Transport                     : ImplicitTls
Protocol                      : Tls12
ConnectionSuccessful          : True
ErrorMessage                  :
NegotiatedProtocol            : Tls12
CipherAlgorithm               : Aes256
CipherStrength                : 256
NegotiatedCipherSuite         : TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384
HashAlgorithm                 : Sha256
HashStrength                  : 256
KeyExchangeAlgorithm          : ECDHE
KeyExchangeStrength           : 256
IsMutuallyAuthenticated       : False
IsEncrypted                   : True
IsSigned                      : True
NegotiatedApplicationProtocol : h2
ForwardSecrecy                : True
CertificateValidationPassed   : True
CertificatePolicyErrors       : None
CertificatePolicyErrorFlags   : {}
CertificateChainStatus        : {}
ElapsedMs                     : 42

PSTypeName                    : TLSleuth.ProtocolTestResult
Hostname                      : github.com
Port                          : 443
TargetHost                    : github.com
Transport                     : ImplicitTls
Protocol                      : Tls11
ConnectionSuccessful          : False
ErrorMessage                  : Authentication failed because the remote party has closed the transport stream.
NegotiatedProtocol            :
CipherAlgorithm               :
CipherStrength                :
NegotiatedCipherSuite         :
HashAlgorithm                 :
HashStrength                  :
KeyExchangeAlgorithm          :
KeyExchangeStrength           :
IsMutuallyAuthenticated       :
IsEncrypted                   :
IsSigned                      :
NegotiatedApplicationProtocol :
ForwardSecrecy                :
CertificateValidationPassed   :
CertificatePolicyErrors       :
CertificatePolicyErrorFlags   : {}
CertificateChainStatus        : {}
ElapsedMs                     : 36

Properties include:

Designed for stable automation and predictable output contracts across both commands.