Use !ssl-ip4 to probe Internet Services that use TLS/SSL and view their SSL/TLS certificates along with their headers or banners. This command retrieves certificate metadata, issuer information, subject fields, SAN entries, expiration dates, and cipher suite negotiation results, giving you a clear understanding of how an IPv4 host identifies itself cryptographically.

!ssl-ip4 is ideal for debugging HTTPS endpoints, validating certificate chains, and confirming that an IPv4 service presents the expected TLS configuration. It also provides insight into protocol negotiation behavior, SNI handling, and virtual hosting setups across the IPv4 Internet.

This command is highly valuable in Internet forensics. Certificate chains, issuer authorities, SAN patterns, and TLS handshake parameters often reveal hosting providers, infrastructure clusters, CDN edges, and operational fingerprints. TLS banners can expose subtle service characteristics that help analysts understand how Internet Services behave and how they are deployed.

The command supports optional protocol selection such as HTTP(S), SMTP, IMAP, and POP, and allows specifying a custom SNI value. This flexibility makes !ssl-ip4 useful for probing mail servers, web servers, and other TLS-enabled IPv4 services.

Usually, !ssl can be used in place of !ssl-ip4

The !ssl-ip4 command has the following syntax:
!ssl-ip4
  <IPv4_Address>(:)(<Port_Number>) [default Port_number: 443]
  (protocol=<App_Protocol>) [http(s)|smtp|imap|pop --default: http(s)]
  (sni=<name>) [any-name-you-want --default: <IPv4_Address>]


Usage:
!ssl-ip4 <ipv4-address>(:<port>) protocol=<app-protocol> sni=<name>

Usage Examples:
!ssl-ip4 8.8.8.8
!ssl-ip4 1.1.1.1 443
!ssl-ip4 9.9.9.9
!ssl-ip4 108.177.127.26:25 protocol=smtp
!ssl-ip4 52.97.160.2:993 protocol=imap
!ssl-ip4 142.251.168.109:993 protocol=imap
!ssl-ip4 162.159.200.1:4460
!ssl-ip4 108.177.119.109:995 protocol=pop
!ssl-ip4 8.8.8.8:443 protocol=http sni=wtvr.test
!ssl 20.70.246.20:443 protocol=http
!ssl 52.101.11.0:25 protocol=smtp
!ssl-ip4 20.231.239.246:443 protocol=https
!ssl 172.65.65.66:25 protocol=smtp
!ssl 74.6.231.21:443 protocol=http
!ssl 98.136.96.74:25 protocol=smtp
!ssl 52.101.50.0:25 protocol=smtp
!ssl 151.101.194.133:443 protocol=https


Also see:
!help !ssl
!help !scan


Note:
To probe Internet daemons that do not use TLS/SSL see: !scan-headers-ip4