Comma

Share a testssl.sh report

testssl.sh produces one of the most complete TLS pictures you can get from a shell, and delivers it as several screens of coloured terminal output — a format with exactly one reader, at exactly one moment.

The people who need it are elsewhere: the platform team who owns the load balancer, the customer security reviewer asking for evidence, the person who runs the same scan in three months and wants to know what changed.

Publish it

testssl.sh --htmlfile testssl.html --quiet "$HOST"

curl -fsS -X PATCH \
  "https://commareports.com/api/v1/reports/$COMMA_REPORT_ID" \
  -H "Authorization: Bearer $COMMA_API_TOKEN" \
  -H "Content-Type: application/json" \
  -d "$(jq -n --rawfile html testssl.html \
        --arg title "TLS — $HOST — $(date +%F)" \
        '{title: $title, html: $html}')"

One report id per host. PATCH appends a revision per scan, so the endpoint has a TLS history — which is what turns "we fixed that" into something you can point at.

Use a scoped token with reports:write only, and keep the report private — see the sharing model. A weak-cipher inventory for a named host is not something to leave on a guessable URL.

What the URL changes

  • Notes land on the finding. "Legacy cipher kept for the POS terminals until Q4, tracked in SEC-310" pinned to the row. See commenting on HTML.
  • Before and after. The revision from before the config change and the one after it, at the same URL. See revisions and diffs.
  • External reviewers get a link with a password if you want one — see password-protected reports.
  • Scheduled rescans. A routine re-scans monthly, so a certificate rotation that quietly re-enabled something shows up.

Limits

  • HTML body: 5 MB. A full scan is comfortably under it; --quiet keeps it smaller still.
  • Scripts run, sandboxed: allow-scripts, no allow-same-origin.
  • 60 requests/minute per token.

Try it

Comma is free — unlimited reports, unlimited commenters, unlimited revision history.

Create your first report →

Related