Use !ssl-ip6 to probe Daemons in the IPv6 Internet that make use of Transport Layer Security (TLS) and view their SSL/TLS certificates along with their headers or banners. This command retrieves certificate metadata, issuer information, subject fields, SAN entries, expiration dates, and cipher suite negotiation results, giving you a clear understanding of how an IPv6 host identifies itself cryptographically.

!ssl-ip6 is ideal for debugging HTTPS endpoints, validating certificate chains, and confirming that an IPv6 service presents the expected TLS configuration. It also provides insight into protocol negotiation behavior, SNI handling, and virtual hosting setups across the IPv6 Internet.

This command is highly valuable in Internet forensics. Certificate chains, issuer authorities, SAN patterns, and TLS handshake parameters often reveal hosting providers, infrastructure clusters, CDN edges, and operational fingerprints. TLS banners can expose subtle service characteristics that help analysts understand how IPv6 Internet Services behave and how they are deployed.

The command supports optional protocol selection such as HTTP(S), SMTP, IMAP, and POP, and allows specifying a custom SNI value. This flexibility makes !ssl-ip6 useful for probing mail servers, web servers, and other TLS-enabled IPv6 services.

Usually, !ssl can be used in place of !ssl-ip6

The !ssl-ip6 command has the following syntax:
!ssl-ip6
  [<IPv6_Address>](:)(<Port_Number>) [default Port_number: 443]
  (protocol=<App_Protocol>) [http(s)|smtp|imap|pop --default: http(s)]
  (sni=<name>) [any-name-you-want --default: <IPv6_Address>]


Usage:
!ssl-ip6 [<ipv6-address>]:<port>) protocol=<app-protocol> sni=<name>

Usage Examples:
!ssl-ip6 2a00:1450:4001:81c:0:0:0:200e
!ssl-ip6 [2a00:1450:4001:806:0:0:0:2004]:443
!ssl-ip6 2a00:1450:4001:806:0:0:0:2004 443
!ssl-ip6 2a00:1450:4013:c16:0:0:0:1b 25 protocol=smtp
!ssl-ip6 [2a00:1450:4013:c16:0:0:0:1a]:25 protocol=smtp
!ssl-ip6 [2a00:1450:4001:806:0:0:0:2004]:443 protocol=http sni=wtvr.test
!ssl-ip6 2a00:1450:4001:806:0:0:0:2004 443 protocol=http sni=wtvr.test


Also see:
!help !ssl
!help !scan

To probe Internet Services that do not make use of Transport Layer Security (TLS) see: !scan-headers-ip6