Which protocol would need to be available on a target in order for Nmap to identify services like IMAPS and POP3S?

Nmap's service version detection uses HTTPS as the mechanism to probe and identify SSL/TLS-wrapped services on a target, including IMAPS (port 993) and POP3S (port 995). When HTTPS is available on the target, it confirms that SSL/TLS infrastructure is operational, allowing Nmap to perform SSL handshakes and extract service banners that distinguish encrypted mail protocol variants from their plaintext counterparts. This capability is defined in Nmap's nmap-service-probes database, which uses HTTPS-based SSL probes to detect these services.

SSL is the underlying cryptographic layer that IMAPS and POP3S use, but it is not the specific application-layer protocol that Nmap requires to be present on the target in order to perform service identification for these services.

LDAP is a directory access protocol with no role in SSL/TLS-based service detection; its presence on a target has no bearing on Nmap's ability to identify IMAPS or POP3S.

TLS is the modern cryptographic protocol underlying these services, but in the context of Nmap service detection the required protocol presence on the target is HTTPS, not TLS independently.