<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# SSL/TLS Audit Templates — API Reference

## Nuclei SSL Protocol Options

```bash
# Basic SSL scan
nuclei -u https://target.com -t ssl-template.yaml -json

# SSL scan with custom port
nuclei -u target.com:8443 -t ssl-template.yaml -json

# Bulk SSL audit
nuclei -l https-hosts.txt -t ssl-templates/ -json -o results.json
```

## SSL Request Fields

| Field | Type | Description |
|-------|------|-------------|
| `address` | string | Target address (`{{Host}}:{{Port}}`) |
| `min_version` | string | Minimum TLS version to test |
| `max_version` | string | Maximum TLS version to test |
| `cipher_suites` | list | Specific cipher suites to test |

## TLS Version Constants

| Value | Protocol |
|-------|----------|
| `ssl30` | SSL 3.0 (deprecated) |
| `tls10` | TLS 1.0 (deprecated) |
| `tls11` | TLS 1.1 (deprecated) |
| `tls12` | TLS 1.2 |
| `tls13` | TLS 1.3 |

## SSL DSL Variables

| Variable | Description |
|----------|-------------|
| `subject_cn` | Certificate common name |
| `subject_an` | Subject alternative names |
| `issuer_cn` | Issuer common name |
| `issuer_org` | Issuer organization |
| `not_before` | Certificate validity start |
| `not_after` | Certificate validity end |
| `serial` | Certificate serial number |
| `tls_version` | Negotiated TLS version |
| `cipher` | Negotiated cipher suite |
| `self_signed` | Whether cert is self-signed |

## Security Header Checks

| Header | Expected Value |
|--------|----------------|
| `Strict-Transport-Security` | `max-age=31536000; includeSubDomains` |
| `X-Content-Type-Options` | `nosniff` |
| `X-Frame-Options` | `DENY` or `SAMEORIGIN` |
| `Content-Security-Policy` | Restrictive policy |
