testssl.sh allows you to scan stuff inside private networks, supports custom ports/SNI, and things like StartTLS.