diff --git a/pkgs/tools/security/sslscan/default.nix b/pkgs/tools/security/sslscan/default.nix
new file mode 100644
index 000000000000..fd06ef3b66c6
--- /dev/null
+++ b/pkgs/tools/security/sslscan/default.nix
@@ -0,0 +1,27 @@
+{ stdenv, fetchurl, openssl }:
+
+stdenv.mkDerivation rec {
+  name = "sslcan-${version}";
+  version = "1.11.0";
+
+  src = fetchurl {
+    url = "https://github.com/rbsec/sslscan/archive/${version}-rbsec.tar.gz";
+    sha256 = "19d6vpcihfqs35hni4vigcpqabbnd3sndr5wyvfsladgp40vz3b9";
+  };
+
+  buildInputs = [ openssl ];
+
+  installFlags = [
+    "BINPATH=$(out)/bin"
+    "MANPATH=$(out)/share/man"
+  ];
+
+  meta = with stdenv.lib; {
+    description = "Tests SSL/TLS services and discover supported cipher suites";
+    homepage = https://github.com/rbsec/sslscan;
+    license = licenses.gpl3;
+    maintainers = with maintainers; [ fpletz globin ];
+    platforms = platforms.all;
+  };
+}
+
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index bfc6c5b5d5f3..13159b42659b 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -3050,6 +3050,8 @@ let
 
   sshpass = callPackage ../tools/networking/sshpass { };
 
+  sslscan = callPackage ../tools/security/sslscan { };
+
   ssmtp = callPackage ../tools/networking/ssmtp {
     tlsSupport = true;
   };