TLS cipher suites
Every cipher suite the scanner's TLS engine (Node.js / OpenSSL) can negotiate is listed below, classified by key exchange, symmetric strength, AEAD vs. legacy CBC, and forward secrecy. This is the universe both tests draw from.
Website test: enumerates every suite individually – it iterates over all TLS 1.0–1.2
suites (with OpenSSL @SECLEVEL=0, so weak suites are offered too) and probes each of the five
TLS 1.3 suites, to report exactly which ones a server accepts.
Mail test (STARTTLS): classifies the suite the mail server negotiates and additionally runs two targeted downgrade probes per MX – one for obsolete TLS ≤ 1.1 and one for the weak families (RC4, 3DES, DES, export, NULL). It deliberately does not enumerate every suite, to keep the number of outbound port-25 connections small (blacklist protection).
Engine note: the list below reflects exactly what our TLS engine (Node.js / OpenSSL) can negotiate. Modern OpenSSL 3.x ships without the long-broken RC4/3DES/DES/export/NULL suites, so those do not appear here and our probes cannot solicit them – a server still offering such a suite simply cannot complete a handshake with us. The remaining legacy entries (CBC mode or static-RSA key exchange) are flagged as legacy/acceptable, not weak.