TLSX — TLS Recon & Subdomain Discovery from X.509 Certificates

Cloud-hosted wrapper around ProjectDiscovery's tlsx. Point it at hosts, IP ranges, or ASNs and pull back structured TLS/certificate data — no local Go toolchain, no binary to install.

Why use this

TLS certificates leak infrastructure. The Subject Alternative Name (SAN) and Common Name (CN) fields on a cert routinely list every hostname it covers — internal tools, staging environments, forgotten subdomains — even ones that never show up in DNS brute-force wordlists or search-engine indexes. This actor grabs that data at scale and hands it back as clean JSON rows, ready to feed into a dataset, a spreadsheet, or the next stage of a recon pipeline.

Typical use cases:

• Subdomain discovery for bug bounty / pentest recon — scan a target's IP ranges (CIDR) or ASN and collect every hostname referenced in certs served on those IPs. Great for finding hosts that DNS enumeration misses.
• Attack surface mapping — enumerate TLS/cipher support, flag expired, self-signed, mismatched, revoked, or untrusted certificates across a fleet of hosts.
• Fingerprinting — grab JARM/JA3 TLS fingerprints to cluster or identify backend infrastructure (e.g. shared C2, CDN, or hosting provider) across otherwise unrelated hostnames.
• Cert monitoring — check expiry dates and issuer chains across your own domains before something breaks in production.
• Certificate Transparency (CT) log streaming — tap the live CT log firehose for near-real-time discovery of newly issued certs matching infrastructure you care about.

Only scan targets you're authorized to test.

Input

Give it targets and (optionally) which data to pull. Targets accept IP, CIDR, ASN, hostname, hostname:port, or full URL:

{
  "host": ["example.com", "173.0.84.0/24", "AS1449"]
}

For subdomain discovery from certs, the default settings already return SAN/CN data in every result — no extra flags needed. Just feed it hosts or IP ranges and read subject_an / subject_cn from the output.

The full input schema (.actor/actor.json) mirrors nearly every tlsx CLI flag, grouped by purpose:

• Targets & scan mode — hosts/CIDR/ASN, ports, IP version, ctls/ztls/openssl/auto connection mode, pre-handshake early termination
• Probes — fingerprint hashes, JARM, JA3, wildcard cert detection, TLS version / cipher enumeration, certificate serial
• Misconfiguration checks — expired, self-signed, mismatched, revoked, untrusted certificates
• Connection config — custom resolvers, SNI, min/max TLS version, custom ciphers, SOCKS5 proxy, cert verification
• Optimizations — concurrency, per-target timeout, retries, delay
• CT log streaming — live firehose mode, bounded by maxRuntimeSecs since it otherwise never terminates
• PDCP dashboard upload — push results to ProjectDiscovery's Cloud Platform

An extraFlags field is included as an escape hatch for anything not explicitly modeled.

Notes:

• The JSON output always includes SAN/CN/cipher/TLS-version/probe-status regardless of the remaining display-only probe flags (-tv, -cipher, ...) — those only affect plain-text CLI output, which this actor doesn't use. -san/-cn aren't exposed as inputs at all: tlsx hard-rejects combining them with any other display probe, and the JSON output includes that data unconditionally anyway.
• cacert expects inline PEM content (pasted in), not a filesystem path.

Output

One dataset row per scanned host/port, in tlsx's native JSON shape:

{
  "host": "example.com",
  "ip": "93.184.216.34",
  "port": "443",
  "probe_status": true,
  "tls_version": "tls13",
  "cipher": "TLS_AES_256_GCM_SHA384",
  "subject_cn": "www.example.org",
  "subject_an": ["www.example.org", "example.net", "example.com", "..."],
  "issuer_cn": "DigiCert TLS RSA SHA256 2020 CA1",
  "not_before": "2022-03-14T00:00:00Z",
  "not_after": "2023-03-14T23:59:59Z"
}

subject_an is the field to pull for subdomain discovery — export it, dedupe, and feed into DNS resolution or an HTTP prober for the next recon step. The raw newline-delimited JSON is also saved to the key-value store under RAW_OUTPUT.