Mail, Directory and Database TLS (STARTTLS)
Mail, Directory and Database TLS (STARTTLS)
Reach the services an HTTPS scan cannot: mail, directory, file transfer, messaging, databases and message queues. Get their certificate, TLS configuration and post-quantum key-exchange verdict, and find the ones still talking in cleartext.
Overview
A standard TLS scan only works when the first byte on the wire is a TLS handshake, which covers HTTPS and little else. Mail, directory and most database protocols start with a short plaintext conversation and only then upgrade to TLS, and several databases and queues serve TLS on their own service port only when the operator enabled it.
This scan type (named starttls in the API and the CLI) handles both cases. Once the connection is ready for TLS, it runs the same certificate handshake and post-quantum key-exchange probe as a domain scan, so the results are directly comparable with your HTTPS endpoints. It sends no credentials and reads no data.
Supported protocols
In-band upgrade
A plaintext exchange precedes TLS. The scanner performs that exchange, then hands the connection to the TLS probes.
| Protocol | Default port | Upgrade |
|---|---|---|
| SMTP (submission) | 587 | EHLO, then STARTTLS |
| IMAP | 143 | STARTTLS command |
| POP3 | 110 | STLS command |
| LDAP | 389 | StartTLS extended operation (RFC 4511) |
| FTP | 21 | AUTH TLS |
| XMPP | 5222 | Stream header, then <starttls/> |
| PostgreSQL | 5432 | SSLRequest |
| MySQL / MariaDB | 3306 | Server handshake, SSL capability check, then SSL request |
TLS on the service port
These services speak TLS from the first byte when TLS is enabled, and plaintext when it is not. There is nothing to negotiate: the TLS handshake itself is the test.
| Service | Default port | Note |
|---|---|---|
| MongoDB | 27017 | Same port with or without TLS |
| Redis | 6379 | Same port with or without TLS (Redis 6+) |
| Kafka | 9093 | Dedicated SSL listener |
| AMQP (e.g. RabbitMQ) | 5671 | AMQPS; 5672 is the plaintext port |
| Cassandra | 9142 | CQL native TLS port |
SMTPS (465), IMAPS (993), POP3S (995) and LDAPS (636) speak TLS from the first byte. Scan them with a domain / TLS scan on that port instead. If you point this scan at one of those ports, the result tells you so rather than reporting the host as unreachable.
What is reported
| Result | What it tells you |
|---|---|
| Post-quantum key exchange | The TLS 1.3 group the server negotiates and whether it is post-quantum (for example the hybrid X25519MLKEM768), plus the post-quantum and classical groups the server accepts. A classical-only server is flagged so you can enable a hybrid group; a server without TLS 1.3 gets an explicit "could not be determined" rather than a guess. |
| TLS configuration | Negotiated TLS version and cipher suite. TLS 1.2 is flagged because only TLS 1.3 carries a standardised hybrid key exchange; versions older than TLS 1.2 and cipher suites without forward secrecy are rated High. |
| Certificate chain | The server certificate and chain, with algorithms and key sizes, inventoried like any other TLS endpoint. |
| Cleartext service | See below: a service that refuses TLS is a Critical finding. |
Cleartext is a finding, not a scan error
| Situation | Severity |
|---|---|
| The server answered but refused to upgrade (for example a mail server that does not offer STARTTLS) | Critical: traffic to it is sent in cleartext |
| MongoDB or Redis: the port accepts TCP but completes no TLS handshake | Critical: the same port carries the cleartext traffic |
| Kafka, AMQP or Cassandra: the dedicated TLS port accepts TCP but completes no TLS handshake | High: the TLS listener is broken; check that clients are not falling back to the plaintext port |
| The server agreed to upgrade but the handshake failed | Info: TLS is offered, but its certificate could not be inventoried |
| The host did not answer, or answered as another protocol | Info: check the host, the port and the firewall rules |
Every finding carries remediation guidance: enable TLS, reject unencrypted client connections, move to TLS 1.3, and configure a hybrid post-quantum key exchange. Database, queue and mail traffic is long-lived and often archived, which puts it squarely in "harvest now, decrypt later" scope.
When to use
Mail and directory estate
Answer 'is our mail and LDAP traffic quantum-vulnerable, or even encrypted at all?'
Databases and queues
Find database and message-queue endpoints that serve cleartext or lack a post-quantum key exchange
How to run
From the Cockpit
Open Run a Scan
In the Cockpit, go to Run a Scan.
Select the source
In Step 1 (Source), choose Mail, Directory & Data Services.
Configure and run
Enter one or more hosts (comma-separated), pick the protocol, and optionally override the port. Start the scan and review the findings.
The scan is sent from the Cockpit, so the targets must be reachable from it. For services on an internal network, run the scan with the scanner agent inside that network (see below).
Through the API
curl -X POST "$COCKPIT/api/pqc/scans" \
-H "Authorization: Bearer $TOKEN" -H "Content-Type: application/json" \
-d '{
"scan_type": "starttls",
"target": "mail1.example.com,mail2.example.com",
"options": { "starttls_protocol": "smtp" }
}'
| Option | Description | Default |
|---|---|---|
starttls_protocol | smtp, imap, pop3, ldap, ftp, xmpp, postgres, mysql, mongodb, redis, cassandra, kafka or amqp | smtp |
port | TCP port | The protocol default port (table above) |
timeout_seconds | Per-step timeout | 10 |
starttls_no_pq_probe | Skip the post-quantum key-exchange probe. Opens far fewer connections per host, but the result has no post-quantum verdict | false |
With the scanner agent (CLI)
# Mail submission servers
dke-scanner-agent starttls --target mail1.example.com,mail2.example.com --protocol smtp
# A PostgreSQL server on a non-default port, human-readable summary
dke-scanner-agent starttls --target db.internal.example.com --protocol postgres --port 6432 --format summary
# Kafka brokers, JSON written to a file
dke-scanner-agent starttls --target kafka1,kafka2,kafka3 --protocol kafka -o kafka-tls.json
See the CLI reference for every option.
From an AI assistant (MCP)
The Cockpit MCP server exposes a scan_starttls tool with the same parameters (target, protocol, port, skip_pq_probe), up to 64 hosts per call. See MCP.
Scanning many hosts? Combine this scan with a domain scan of your HTTPS endpoints: the key-exchange verdicts use the same probe, so the results line up in the same inventory and Quantum Risk Score.