TLS Scanner
Protocols, ciphers and certificates, graded.
Typical useGet warned before a certificate expires or a change turns on a weak TLS protocol.
Grade a server's TLS: protocols, cipher suites and the certificate chain, including upcoming certificate expiry — for web, mail and any other TLS port.
Free to start on every tool — no card, no time limit. You pay only for what grows beyond the free tier. Sign in with your qzila account to use it.
What it checks
- Weak protocols and ciphers (SSLv3, TLS 1.0/1.1, RC4, 3DES, export suites)
- Certificate chain, hostname match, expiry countdown
- Forward secrecy, OCSP stapling, key strength
- Alerts before a certificate expires and when the grade drops
How this tool bills
Indicative prices, EUR excl. VAT. The current price list is in your account and applies from the day you add something.
Pricing examples
Three typical situations, worked through the way the invoice would show them. Prices are indicative; the current price list is in your account.
- Example 1 · Trying it out2 endpoint watcheds
A freelancer or a small company signs in and adds 2 endpoint watcheds to see what the tool finds.
Everything you add is within the free tier (2 endpoint watcheds free every month), so nothing is billed. There is no time limit — it stays free while you stay within it.
2 − 2 free = 0 × €1.50Monthly bill: €0.00 — free. - Example 2 · A small company6 endpoint watcheds
A company adds 6 endpoint watcheds — its main systems and a couple it acquired along the way.
The first 2 are covered by the free tier. The remaining 4 are billed at €1.50 each, metered per month.
6 − 2 free = 4 × €1.50Monthly bill: 4 × €1.50 = €6.00/ month. - Example 3 · An agency or a larger estate20 endpoint watcheds
An MSP, an auditor or a larger company watches 20 endpoint watcheds across several clients or business units.
The free tier still covers the first 2. The other 18 are billed at €1.50 each. Remove something mid-month and it stops counting the same day; set a budget and you are warned before you reach it.
20 − 2 free = 18 × €1.50Monthly bill: 18 × €1.50 = €27.00/ month, itemised on one invoice.
Try your own numbers
The API
Every qzila tool is a GraphQL API first; the web UI is one client of it. Anything you can do in the browser you can do from a script, a CI job or the Asign platform.
https://tls.tools.qzila.com/graphqlPOST · application/json · { "query": "…" }
Requests are authenticated with your qzila session (the same sign-in as the browser). For automation, sign in once at identity.qzila.com and reuse the session cookie; API keys for service accounts are on the roadmap.
Whatever this tool detects — a verdict flip, a regression, a change, an incident — is emitted as a signal to the qzila alert hub, which forwards it to email, Slack, a webhook, SMS or Jira, and to ServiceWatch. Each signal carries the asset it belongs to, so you can correlate it back to your own inventory (or to an Asign asset).
Main operations
scanmutationScan a host (port defaults to 443) and get protocols, ciphers, certificate chain and the grade.
mutation { scan(host: "example.com:443") { grade protocols { name enabled } certificate { notAfter issuer } } }sessionHistoryqueryYour scans and their grades over time.
query { sessionHistory { host grade scannedAt } }reportqueryThe stored report for one host.
query { report(host: "example.com") { grade findings { severity title } } }
Send requests to https://tls.tools.qzila.com/graphql
Questions about TLS Scanner
What is tested?
Supported protocol versions (TLS 1.0 to 1.3), cipher suites and their order, key exchange, the certificate chain, hostname match, expiry, OCSP stapling and known weaknesses such as RC4, 3DES or missing forward secrecy.
Can I scan a mail server or a non-web port?
Yes — give host:port. STARTTLS is used for SMTP, IMAP and POP ports automatically.
When am I warned about an expiring certificate?
At 30, 14, 7 and 1 days before expiry, and again the day it expires — to email, Slack, a webhook or wherever your alert rules point.
Does it scan from outside my network?
Yes, from EU-based scanners, so you see exactly what a client on the internet sees. Internal hosts need to be reachable from there.
Is the free tier a trial?
No. It stays free for as long as you stay within it — no card, no time limit. You only start paying when you add more than the free tier covers.
How am I billed?
Monthly, for what you actually had in the tool during the month, at the public price per unit. Everything lands on one invoice itemised per tool. Remove something and it stops billing the same day.
Where do alerts go?
Every tool reports through one alert hub. You choose per destination: email, Slack, a webhook, SMS or a Jira ticket — and ServiceWatch shows the same signals on one board.
Where is my data kept?
In the European Union. qzila is built and operated by adcore s.r.o., a Slovak company; the tools run on EU infrastructure.
Start with one tool. Add the rest when you need them.
Sign in once and every tool is a click away. You pay only for what you watch, per month, with no minimum and no contract — the price list is in your account before you add anything.
- One account across every qzila tool
- Free tier on every tool, then pay-as-you-go
- Alerts to email, Slack, webhook, SMS or Jira