I am trying to query all the https sites on various server VLANs within my network. I can get a list of servers listening on tcp/443 with nmap, and get even more information about the certs using some of the nmap scripts (e.g., ssl-cert.nse). However, some servers are utilizing SNI, so just scanning by IP address only shows the "default" server that answers at a particular address (i.e., no HOST specified in the HTTP header).

openssl s_client has the parameter -servername that overcomes this limitation. I suppose one solution would be to get a list of hosts listening on tcp/443 from nmap, and pass that information to openssl rather than an nmap ssl script. I haven't looked, but cURL may also have this ability. It would be nice to do the whole thing in nmap if possible though.

For the sake of argument, let's say that I have a list of hostnames. Can anyone think of a "pure-nmap" solution to identifying certification information (e.g., expiration date, hash algorithm, etc)?

1 Answer 1


The easiest way is to pass in just the hostnames and let Nmap do the name resolution. In this case, all the ssl-* NSE scripts will use SNI to pass the server name you passed on the command line. That's not always possible, of course. Some times you have to specify IP address and you still want to provide or detect the hostname.

Over on Nmap's Github repo there is a pull request to add a script argument that will do just that. It can only handle one name at a time, but it's worth trying out. I'll probably be adding it to the next Nmap release, now that you've brought it back to my attention.

A more complete solution might be to allow users to provide a reverse mapping of IP address to name. We already have that present in the reverse-DNS (PTR) records, but these are not always the names that TLS services actually use. You are more than welcome to chime in on Github or via the nmap-dev mailing list.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .