# Share a testssl.sh Report — TLS Findings on a Link

Canonical: https://commareports.com/share-testssl-report
Published: 2026-09-01

> testssl.sh writes an HTML file with --htmlfile. Publish it to Comma for one URL per host, anchored notes on individual cipher findings, and a revision every time you re-scan.

# Share a testssl.sh report

`testssl.sh` produces one of the most complete TLS pictures you can get
from a shell, and delivers it as several screens of coloured terminal
output — a format with exactly one reader, at exactly one moment.

The people who need it are elsewhere: the platform team who owns the
load balancer, the customer security reviewer asking for evidence, the
person who runs the same scan in three months and wants to know what
changed.

## Publish it

```bash
testssl.sh --htmlfile testssl.html --quiet "$HOST"

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html testssl.html \
        --arg title "TLS — $HOST — $(date +%F)" \
        '{title: $title, html: $html}')"
```

One report id per host. `PATCH` appends a revision per scan, so the
endpoint has a TLS history — which is what turns "we fixed that" into
something you can point at.

Use a [scoped token](/docs/api-tokens) with `reports:write` only, and
keep the report **private** — see the [sharing model](/docs/sharing). A
weak-cipher inventory for a named host is not something to leave on a
guessable URL.

## What the URL changes

- **Notes land on the finding.** "Legacy cipher kept for the POS
  terminals until Q4, tracked in SEC-310" pinned to the row. See
  [commenting on HTML](/comment-on-html).
- **Before and after.** The revision from before the config change and
  the one after it, at the same URL. See
  [revisions and diffs](/share-html-report).
- **External reviewers get a link** with a password if you want one — see
  [password-protected reports](/password-protect-html-report).
- **Scheduled rescans.** A [routine](/docs/routines) re-scans monthly, so
  a certificate rotation that quietly re-enabled something shows up.

## Limits

- **HTML body: 5 MB.** A full scan is comfortably under it; `--quiet`
  keeps it smaller still.
- **Scripts run, sandboxed**: `allow-scripts`, no `allow-same-origin`.
- **60 requests/minute per token.**

## Try it

Comma is free — unlimited reports, unlimited commenters, unlimited
revision history.

**[Create your first report →](https://commareports.com/)**

### Related

- [Nikto scans](/share-nikto-report) — the layer above TLS
- [Nmap output](/share-nmap-report) · [ZAP reports](/share-zap-report)
- [Security scan reports](/share-security-scan-report) · [Publish from CI](/docs/ci)